Passphrases Explained

Creating a Passphrase

So your IT Team has just mandated new password policies that require to you have 15 characters and a really complex password.

How am I supposed to handle that and remember this nonsense?

Good news, you can create a passphrase. A passphrase is exactly what it sounds like - a phrase. As opposed to a random password that you may or may not remember, a passphrase can be a sentence or phrase that you can easily remember on a daily basis. It can even be about what you ate for lunch!

Let's compare a traditional password to a passphrase:

The strength of a 9 character password

Although our password strength is "good", the estimated time to crack the hash is only 4 hours.

The strength of a passphrase

A 41 character passphrase estimated to take a lifetime to crack.

A simple passphrase brings our character count to 41 (spaces count as characters!), while also including a symbol to meet password strength requirements. This is a simple phrase that is rather easy to remember but nearly impossible to guess, and even more impossible to crack anytime this decade.

Still think you can't create a passphrase?

Let's take a step back and breathe - you can do it if you try. If you can use a keyboard and type out a chat message or an e-mail, then you can type a passphrase. Let's use an angry e-mail as an example.

My e-mail to support showing my displeasure.

Here's an e-mail that we've received, really voicing disapproval of this new policy. But wait, somebody was able to take the time to type this out just fine! Let's take a closer look.

Another 40 character password, just like that!

This phrase seems to meet our requirements! It's longer than 15 characters (it's 40!), it has uppercase and lowercase letters, and it includes at least 1 special character. I bet I could remember how to type this on a daily basis. What else can we do with this e-mail?

Now it's 47 characters!

Now it's even longer! A whole 47 characters and it's a breeze to remember. The IT Team will be happy with this, and attackers will be left spinning their wheels trying to crack your new passphrase.

If you can type a message, then you can type a passphrase.

This article was updated on October 7, 2024