How to create a passphrase that beats a complex password

Overview

A passphrase is a password made from four or more random words, like lantern biscuit orbit cactus. It is long, which is what makes it hard to break, and it is made of real words, which is what makes it easy to remember.

This guide shows you how to make one in about five minutes.

The best place to create a passphrase is inside a password manager, and the best place to keep it is there too. The manager makes a different passphrase for every login and fills it in for you, so you never have to remember any of them. The one passphrase you do have to remember is the master passphrase that opens the manager, and this guide is for that one, and for any other login you have to type from memory, such as your computer.

One rule above all others: no two logins should ever share the same username and passphrase combination. Your username is usually your email address, and it is the same everywhere. If your passphrase is the same everywhere too, one breach unlocks everything.

Why longer beats more complicated

For years we were told a strong password needed a capital letter, a number and a symbol. So people wrote things like Summer2024! and attackers learned every habit: the capital goes first, the number goes at the end, the symbol is an exclamation mark.

Length is what slows an attacker down. Every extra character multiplies the number of guesses needed. Four random words give you 20 or more characters without a single symbol to remember.

The Australian Signals Directorate’s Australian Cyber Security Centre (ACSC) recommends at least four random words and at least 14 characters. Consider IT recommends a minimum of 16 characters, which four ordinary words will almost always give you.

If you want the full story on how passwords get cracked and why the old rules changed, read our blog post: Why a passphrase beats a complex password.

Before you start

Nothing to install and nothing to ask us for. Have these ready.

• The login you are changing. Know which system you are setting the passphrase on, and be signed in to it.
• Two uninterrupted minutes. You will say the words to yourself a few times, and that works better without someone talking to you.

Steps

The passphrase you build here is not something you type anywhere in these steps. You create it, then set it in whichever system you are changing.

1. Pick four words that have nothing to do with each other. Random is the important part. Open a book to four different pages and take one word from each, or look around the room and pick four unrelated objects. Do not use a sentence, a song lyric, a quote, or anything about you (pet names, street names, footy teams). Those are the first things an attacker tries.

Tip: You do not have to think up the words yourself. In order of preference: let your password manager generate the passphrase and save it, which is the right choice for every login except the master passphrase that opens the manager. If you are creating that master passphrase, or you do not have a password manager yet, use the free passphrase generator at bitwarden.com/passphrase-generator instead. No account is needed. Set Words to 4 or more, keep the separator as a space or a hyphen, and click Regenerate until you get four words you can picture. Leave Capitalize and Include number off unless the system you are changing insists on them. Picking the words yourself, as in step 1, is the third option and works fine if you follow the rules.

1. Count the characters. Your four words together need to be at least 16 characters, counting spaces. cat dog sun hat is 15 and falls short. lantern biscuit orbit cactus is 28 and fine. If you are short, swap in a longer word.
2. Decide how to join the words. Spaces are best if the system allows them. If it does not, put a hyphen between each word, like lantern-biscuit-orbit-cactus. Running the words together with no separator also works but is harder to type accurately.
3. Add a capital letter or a number only if the system insists. Some systems still demand them. If yours does, put a capital at the start of one word and a number between two words, and keep it the same every time. Lantern biscuit 7 orbit cactus meets most rules.
4. Type it in three times. Once in the new password box, once in the confirm box, and once more after you sign out and back in. If you can type it three times today, you will remember it tomorrow.
5. Use it for this login only. Never use the same username and passphrase combination on two different systems. Attackers take the email-and-passphrase pairs leaked in one breach and try them on every other site, automatically. If your pair is unique, a breach somewhere else cannot touch this login. Let your password manager make and remember a different passphrase for every login. Then the only passphrases you carry in your head are the master passphrase for the manager and your computer login, and most people need nothing more than that.

Do not use the examples in this guide. They are now public, which means they are on an attacker’s list.

Troubleshooting

If you have been using the same passphrase on more than one login, change it on the most important ones first: your email, your password manager, your bank. Work through the rest as you sign in to them over the next week. You do not have to fix everything today.

If the system says your passphrase is too weak, it almost certainly wants a capital, a number or a symbol. Add one of each between two of the words (see step 4), not at the very end.

If the system will not accept spaces, use a hyphen between each word instead. The passphrase is just as strong.

If the system has a maximum length and yours is too long, swap one or two words for shorter ones. Stay at 16 characters or more.

If you cannot remember it the next day, your words were too random to picture. Choose four unrelated words you can turn into one silly mental image (a cactus wearing a lantern, eating a biscuit, in orbit). It stays unpredictable to an attacker but sticks in your head.

If you have more logins than you can keep passphrases for, that is the job of a password manager. The Keeper guide explains how Consider IT sets that up.