Passphrase vs Password: Diceware, Entropy & Modern Password Policy
Security guidance shifted from “complexity rules” to length + uniqueness. Users search passphrase generator, diceware, and password entropy calculator while admins implement NIST SP 800-63B-inspired policies: block breached passwords, encourage password managers, and avoid forced periodic resets without cause. This article explains bits of entropy, why four random words can beat nine-character passwords with @! tacked on, and how Have I Been Pwned-style APIs integrate at login.
Designing policy developers can defend
Minimum length (often 12–16+), blocklist common passwords, rate-limit authentication, and log only metadata about failures. Pair UX copy with inline strength meters that reward length, not gimmicks.
Password managers and passkeys
Passkeys (WebAuthn) reduce phishing surface; passphrases remain relevant for master passwords and vault recovery codes. Document recovery flows carefully.
Patterns that look strong but are not
Storage at rest: bcrypt, Argon2, and pepper
Strong user-chosen secrets still fail if servers store plaintext. Hash passwords with adaptive algorithms—see our bcrypt guide—and tune cost parameters as hardware improves. A server-side pepper (secret key mixed into hashes) limits blast radius when database dumps leak, but rotation requires careful migration plans.
UX, copy, and passwordless onboarding
Show strength meters that reward length over forced symbol soup. Offer OAuth and passkeys where regulatory constraints allow—passphrases still matter for vault unlock codes and device backup. Avoid blocking paste on password fields; it drives password managers away and weakens security overall.
Threats: credential stuffing, phishing, and support desk resets
Breached passwords are tested against every popular site—unique credentials per service contain damage. Support workflows that reset passwords via SMS alone inherit SIM-swap risk. Align with password security fundamentals for rate limits, CAPTCHAs, and anomaly detection.
Recommended tools on Universal Dev Tools
Sample wordlist-style secrets for vault recovery or high-entropy demos.
Machine-random strings when humans should not memorize per-site credentials.
Inspect cost factors when testing server-side hashing configurations.
Create random tokens for service accounts separate from user passwords.
Related guides on this blog
Frequently Asked Questions
What is passphrase entropy?
Entropy measures unpredictability in bits. Random four-word passphrases from large dictionaries can exceed entropy of short passwords with forced symbols—length and randomness beat leetspeak patterns.
What is Diceware-style generation?
Roll dice or use CSPRNG to pick words from a published list. The list can be public; security comes from random selection, not secrecy of words.
Should I require special characters in passphrases?
Mandatory complexity rules often reduce usability without adding entropy if users pick predictable substitutions. Prefer minimum length checks and breach detection.
Are password managers still needed?
Yes—humans cannot memorize unique high-entropy secrets per site. Passphrases help where managers are unavailable; managers remain best for random machine-generated secrets.
How does MFA interact with passphrase policy?
MFA stops stolen password reuse even when passphrases leak. Combine both for high-value accounts.
What about Unicode passphrases?
Unicode increases entropy per character but watch normalization (NFC vs NFD) and keyboard input issues across devices.
Wrapping up
Generate candidates locally, store them in a trusted vault, and never reuse across sites—regardless of passphrase or random password.