Memorable does not have to mean weak
People make weak passwords when they try to be memorable on their own, because human choices are predictable. Here the words are picked at random from the EFF’s list of 7,776 words, so the result is easy to recall but still unpredictable.
The default of three capitalized words and two digits gives about 45 bits of entropy. That is solid for online accounts that limit login attempts. For anything an attacker could test offline, such as a disk encryption password, use the passphrase generator with five or more words.
Tips
- Picture a scene with the words in order. “Maple Orbit Canyon” becomes a maple tree floating above a canyon.
- Add a fourth word instead of more digits if you want extra strength. Each word adds almost 13 bits, while a digit adds about 3.3.
- Keep the hyphens. They make the password easier to read back and to type on a phone.
Frequently asked questions
Are word-based passwords easy to crack?
Only when the words are chosen by a person. Random words from a 7,776-word list are hard to guess, because every word multiplies the possibilities by 7,776. Three words and two digits already give about 47 trillion combinations.
Where do the words come from?
From the EFF large word list, published by the Electronic Frontier Foundation for generating passphrases. Its words were chosen to be easy to spell, type and remember.