Passwords and passphrases get used interchangeably, but they describe different approaches to the same problem: proving to a system that you are who you say you are. Understanding the difference, and what current guidance actually recommends, is worth knowing before you set your next password.
What is a passphrase?
A passphrase is a sequence of random words used as a login credential instead of a single complex word with letters, numbers, and symbols. The idea is straightforward: length is more important than complexity when it comes to how hard something is to guess or crack.
A password like P@ssw0rd! is short, looks complex, and is genuinely weak because millions of people use predictable substitution patterns exactly like it. A passphrase like carpet lemon thursday is longer, looks simpler, and is significantly stronger because its length makes it exponentially harder to crack by brute force.
What makes a good passphrase?
The UK’s National Cyber Security Centre (NCSC) recommends the three random words approach: pick three words that have no connection to each other or to you personally, and use them together as your passphrase.
A good passphrase is:
- Random. The words should have no connection to each other, to your name, your pets, your birthday, or anything else guessable. “carpet lemon thursday” is good. “fluffy-birthday-2024” is not, because two of those words are predictable.
- Long. Three average-length words gives you somewhere between 15 and 25 characters, which is far longer than most passwords. Length is what provides the security.
- Unique. Like any password, a passphrase should be used for one account only. Reusing the same passphrase across multiple accounts means a single breach exposes all of them.
What about complexity rules?
The old advice — mix uppercase and lowercase, add numbers and symbols, change it every 90 days — has been substantially revised by NCSC and other security bodies. Here’s why.
Forcing complexity leads people to make predictable choices: capital letter at the start, number at the end, one symbol in the middle. These patterns are well-known to attackers and to the tools they use. A short complex password following these rules is often weaker in practice than a longer, simpler passphrase.
Current NCSC guidance specifically discourages mandatory complexity rules and encourages the three random words approach instead. If a system forces you to add a number or symbol to your passphrase, add one, but the length of the passphrase is still what’s doing the security work.
Types of passphrases
Random word passphrases are the recommended standard. Three or more genuinely unconnected words, no personal references, no obvious patterns. “umbrella fence october” is a good example.
Sentence passphrases use a short phrase or sentence rather than individual words. “the cat sat slowly” is longer than most passwords and easier to remember than a string of symbols. These work well but are slightly weaker than fully random word combinations since sentence structure follows predictable patterns.
System-generated passphrases are created by a password manager rather than chosen by a person. These are the strongest option since they remove human choice from the equation entirely — human beings are reliably bad at picking things at random.
A passphrase alone is not enough
This is the most important point, and it’s one the old advice usually missed entirely.
Even a strong, genuinely random passphrase only protects you up to the point where someone obtains it — whether through a data breach, a phishing attack, or a leak from another site where you reused it. Once the passphrase is compromised, the account is compromised.
Multi-factor authentication (MFA) closes that gap. With MFA enforced, a stolen passphrase isn’t enough to access the account — the attacker still needs the second verification step. This is why we enforce MFA across every account for every client, with no exceptions, regardless of how strong the password or passphrase is.
A strong passphrase plus MFA is significantly more secure than either alone. A strong passphrase without MFA is still a single point of failure.
For more on how we enforce MFA and why it matters more than password complexity, see our MFA vs 2FA page.
One monthly fee. One number to call.
Getting the basics right — strong credentials, MFA enforced everywhere, properly managed across your whole business — is exactly what we do.
