Passwords remain ubiquitous despite their flaws. Users are often urged to create complex passwords to protect our devices, assets and data. It’s also why the UK Government passed new regulations on 29th April 2024 mandating that any internet-connected smart device can no longer use and maintain easily guessable default passwords such as “12345” or “admin” etc.

It is, of course, quite common to be asked to use 8+ character passwords that must include multi-case letters, numbers, special characters and punctuation. The problem is that generating and remembering them as a challenge which often results in poor password handling hygiene.

This is why we recommend using passphrases instead.

What is a passphrase?

A passphrase is a memorable phrase, usually consisting of a sequence of variable words, either with or without spaces. It can be a series of related words or completely abstract. Either way, it should be something you know and will easily remember. We suggest you use a minimum of three words with a combined length of 15-30 characters.

Here’s a 22 character example: Cheesy drains coughing. 
This passphrase would take up to 2000 years to crack!

By contrast, an 8 mixed-character password such as T6u:g8Y! would take only 26 years to crack.

Passphrases help improve security.
Compared to traditional passwords that use a mix of characters, 3+ random words offer significantly more complexity. This makes them much harder to crack using brute-force attacks or password guessing.

Passphrases are easier to remember:
Randomly chosen words are typically easier to memorise than complex passwords that combine special characters and numbers. Humans are more adept at remembering unique phrases than nonsensical character combinations.

Spaces count!
That’s right. As shown above, there’s no reason why you shouldn’t use spaces. It’s not only easier to remember, it makes your passphrase longer, thus more secure against hacking.

Passphrases reduce the reliance on password managers.
While password managers are highly secure, not everyone wants to use them. Multi-word passphrases offer a more user-friendly alternative for those who prefer to remember their own passwords.

Passphrases reduce the risk of dictionary attacks.
Dictionary attacks rely on pre-existing words or common phrases to be effective. Random, unrelated words are far less vulnerable to this method of hacking.

Passphrases naturally align with human memory.
Research in cognitive psychology have proven that our brains are more adept at remembering information that forms either a narrative or has contextual meaning than random strings of characters.

Passphrases help reduce password fatigue and the risk of reuse.
Password fatigue is stress and frustration brought about from managing too many passwords. It can lead to using weaker passwords, reuse, or forgotten credentials, all increasing security risks.

However…

Remember the importance of randomness.
The effectiveness of 3+ word passphrases relies heavily on choosing truly random, unrelated words. Using dictionary words, personal information, or sequential words like “my password 123” can diminish its security strength.

You’re still exposed to social engineering.
If bad actors can guess some of your personal details, they may still be able to predict the words you chose. So, be sure to be inventive and random.

Don’t write down your passphrases.
Like all passwords, It’s not advisable to write down passphrases. As with any password or phrase, if it can be found, it can be exploited.