Passphrase examples
What strong and weak passphrases look like, and why. The strong examples below are generated fresh in your browser each time you load the page.
Examples are generated in your browser. Turn on JavaScript to see them.
Weak examples that look strong
| Example | Why it fails |
|---|---|
| correct horse battery staple | Famous since xkcd #936; in every cracking dictionary. |
| To be or not to be, that is the question | Quotes, lyrics and proverbs are harvested into phrase lists. |
| sunshine-summer-beach-holiday | Related words. Each one predicts the next. |
| MyDogBuster2015! | Personal facts plus year plus "!". Found on social media, guessed by rules. |
| P@ssphr4se-G3nerat0r | Leetspeak substitutions are among the first rules cracking tools try. |
What the strong ones have in common
- Chosen by a random process, not a person, so no word hints at the next.
- Enough words: five or more from a large list.
- Used once. A strong passphrase reused on a site that leaks is no longer strong.
More on the reasoning in what is a passphrase?. Or skip ahead and generate yours.
Questions
What is an example of a strong passphrase?
Something like "tassel-gumball-overhang-dispute-prism-nectar": six unrelated words picked at random from a 7,776-word list, giving 77.5 bits of entropy. Don't copy a published example; generate your own.
What are examples of weak passphrases?
Song lyrics, quotes, proverbs, famous phrases like "correct horse battery staple", and strings of related words such as "summer-beach-holiday-sunshine". They are long but predictable, and attackers' wordlists include them.
What is a strong password example?
Either a long random string from a password manager (for example 20 random characters), or a random passphrase of five to seven words. Both are strong; only the passphrase is realistic to memorise.