Why passphrases work better
For years, the advice was to make passwords short and complicated: a capital letter, a number, a symbol, change it every 90 days. That produced passwords like Welcome1! that are hard for people to remember and easy for attackers to guess. Current guidance from NIST (the U.S. National Institute of Standards and Technology) has moved firmly toward length over complexity.
A passphrase is a password made of several random words, like Lantern-Maple-Orbit-Cushion42. It's long, so it's hard to crack. It's made of real words, so it's easy to remember and type on a phone. The key word is random: the words must be picked by a computer, not by you. A phrase you choose yourself — a song lyric, your kids' names, your street — is far easier to guess.
How this generator works
The generator picks words at random from a built-in list of more than 2,500 common, inoffensive English words, using your browser's cryptographic random number generator (the same kind used for encryption). Nothing is downloaded or sent when you click Generate. You can choose:
- Number of words — more words means more strength. Five is a good default; use six or more for a password manager's master password.
- Separator — hyphens are easy to read and type. Some systems don't allow spaces.
- Capitals, a number or a symbol — useful when a website insists on them. They add a little strength; more words add a lot.
What the entropy number means
Entropy, measured in bits, describes how many guesses it would take to find a randomly generated password. Each extra bit doubles the work. Because every word comes from a list of more than 2,500, each word adds about 11 bits.
| Words | Approximate entropy | Good for |
|---|---|---|
| 3 | ~34 bits | Not enough on its own; only with multi-factor authentication on low-value accounts |
| 4 | ~45 bits | Everyday accounts protected by multi-factor authentication |
| 5 | ~57 bits | Most work and personal accounts |
| 6+ | ~68 bits and up | Password manager master password, computer login, admin accounts |
Where to use a passphrase
You don't need to memorize a passphrase for every account — that's what a password manager is for. Save your memorized passphrases for the handful of things you have to type yourself:
- Your password manager's master password. This one protects everything else, so make it six words or more.
- Your computer sign-in, if you don't use a PIN, fingerprint or face sign-in.
- Your work email account (Microsoft 365 or similar), which is the key to resetting most other passwords.
- Wi-Fi passwords for the office network, where a long but readable phrase is easier to share with the right people than a random string of symbols.
For everything else — websites, vendor portals, insurance portals — let the password manager generate and remember a long random password.
What makes a password weak
Attackers don't guess passwords one character at a time. They start with lists of passwords leaked from earlier breaches, then try common words with predictable changes: a capital first letter, a year or a few numbers on the end, an exclamation point, letters swapped for look-alike numbers (P@ssw0rd). That's why Summer2026! looks complex but falls quickly, while a string of random everyday words holds up far better. The more personal and predictable a password is — a pet's name, a child's birthday, the practice name — the faster it falls.
About the strength checker
The checker estimates how hard a password would be to guess. It looks at length and the kinds of characters used, then lowers the score for patterns attackers try first: common passwords, keyboard runs like qwerty, sequences like 1234, years, repeated characters, and the classic "Capital word + numbers + !" pattern. It then gives two rough time-to-guess figures: one for an attacker guessing offline after a data breach, and one for guessing online, where login attempts are limited.
Treat the times loosely. Real crack times depend on how a website stores passwords and who is attacking. And the biggest risk isn't a weak password — it's a reused one. If the same password is used on a site that gets breached, attackers will try it on your email, your bank and your practice software.
Password rules for a small office or practice
- Use a password manager. It creates and remembers a unique password for every site. Your team only needs to remember one strong passphrase. See our glossary entry on password managers.
- Turn on multi-factor authentication (MFA). MFA stops most attacks that rely on stolen passwords. Our multi-factor authentication guide explains the options.
- Never share logins. Shared front-desk accounts make it impossible to see who did what, which matters for HIPAA. Check yourself with our HIPAA security self-assessment.
- Stop forced 90-day changes and change passwords only when there's a reason to.
- Consider passkeys. Passkeys replace passwords with a sign-in tied to your device and are resistant to phishing. Microsoft 365 and many other services now support them.
For the full NIST guidance, see NIST SP 800-63B, Revision 4. To check how ready your business is for a cyber insurance application — which almost always asks about MFA and passwords — try our cyber insurance readiness quiz.
Beefed Up IT sets up password managers, multi-factor authentication and passwordless sign-in for small businesses and medical and dental practices as part of our managed IT services. Talk to us if you'd like help rolling it out to your team.