Passphrases vs Random Passwords: The Entropy
4 to 7 random words against a 12-character password, in bits and time to guess.
By the TurantTools Dev team · Updated October 27, 2026 · 3 min read
A passphrase of random dictionary words (like harbor-velvet-cactus-ninety-orbit) is easier to remember and type than a random string, and can be just as strong, as long as the words are picked at random and not chosen by you.
Strength of random-word passphrases (7,776-word list)
| Length | Entropy | Rating | Time to guess at 100 billion a second |
|---|---|---|---|
| 4 words | 52 bits | weak | 5.1 hours |
| 5 words | 65 bits | good | 4.5 years |
| 6 words | 78 bits | good | 35 thousand years |
| 7 words | 90 bits | strong | 272 million years |
For comparison, a random 12-character password using all four character sets has about 77 bits.
How to do it right
- Use dice or a generator to choose the words; "favourite things" are far easier to guess.
- Five or six words is plenty for most accounts; use a password manager for everything else.
- Separators and capitals add little; extra words add a lot.