Password Generator Memorizable vs Random Passwords Why CorrectHorseBatteryStaple Beats xK9#mP2v — and When You Still Need Both

You sign up for a new service. The password generator offers you two options: xK9#mP2v!qL5 (random, 12 characters) or correct-horse-battery-staple (passphrase, 4 words). Which one is more secure? The answer: they are roughly equivalent, and the passphrase is infinitely easier to remember.

The random password has 12 characters from a set of roughly 72 possible characters (uppercase, lowercase, digits, symbols). The passphrase has 4 words from a dictionary of roughly 7,776 common words. The math: 72¹² ≈ 1.9 × 10²² possible random passwords. 7776⁴ ≈ 3.7 × 10¹⁵ possible passphrases. The random password has more entropy — about 74 bits vs 52 bits. But 52 bits of entropy still means an attacker making 1 trillion guesses per second (the upper limit of current hardware) would need about 1.5 years to crack it. For most people, 52 bits is plenty.

Here is when to use each method, and why the best password strategy uses both.

Random Passwords: Maximum Entropy, Minimum Memorability

A 16-character random password from a set of 72 characters has about 98 bits of entropy. At 1 trillion guesses per second, cracking it would take longer than the age of the universe. It is mathematically uncrackable by any current or foreseeable technology. It is also completely unmemorable. You will not remember vJ9#kL2@mP5!xR8. You will store it in a password manager.

Use random passwords for: accounts stored in a password manager (you never need to type them), accounts with high security requirements (banking, email, domain registrar), and any account where you can paste the password and never think about it again. The password manager remembers it. You do not need to.

Use a password generator to generate random passwords. Do not make up your own "random" passwords — humans are terrible at generating randomness. Your "random" password almost certainly follows a pattern that a password cracker will exploit.

Passphrases: High Entropy, High Memorability

A 4-word passphrase from a 7,776-word dictionary has about 52 bits of entropy. A 5-word passphrase has about 65 bits. A 6-word passphrase has about 78 bits. The words are randomly selected, not chosen by you — "correct horse battery staple" is the famous example from the XKCD comic that popularized this method. The words have no logical connection. They are just four random words from the dictionary.

The security comes from the randomness of the selection, not from the words themselves. If you choose the words — "my dog's name, my birthday, my favorite band" — the passphrase is weak because your choices are predictable. If the generator randomly selects the words, the passphrase is strong. The randomness is the security. The words are just the encoding.

Use passphrases for: accounts you need to type manually (your computer login, your phone unlock code), accounts where you cannot use a password manager (smart TV, game console), and the master password for your password manager itself — the one password you actually need to memorize. Four to six random words, separated by hyphens or spaces, is both secure and memorable.

The Strategy: Passphrase for the Vault, Random for Everything Else

Memorize one strong 5-6 word passphrase — the master password for your password manager. Use random 16-character passwords, generated by the password generator, for every other account. Store them in the password manager. You never need to type them. You never need to remember them. You only need to remember the one passphrase that unlocks the vault.

This is the security strategy that maximizes both security and convenience. One memorable passphrase. Hundreds of unmemorable random passwords. The best of both worlds.