Passwords should be Passphrases

Body

Why Passphrases?

An xkcd webcomic comparing password strength and memorability. The top row analyzes a complex password like Tr0ub4dor&3, labeling it as having low entropy, being easy for a computer to guess in 3 days, and hard for a human to remember. The bottom row analyzes a multi-word password, correct horse battery staple, labeling it as having higher entropy, being hard for a computer to guess (taking 550 years), and easy for a human to remember. The caption at the bottom reads, "Through 20 years of effort, we've successfully trained everyone to use passwords that are hard for humans to remember, but easy for computers to guess."

It turns out that much of what you have learned about how to create a strong secure password is no longer the best advice. The web comic XKCD covers it best in this comic.  

Password length beats randomness for both security and memorability. Current advice recommends using a passphrase of at least five random words.

Create a passphrase

Using Passphrases 

Passphrases and password managers

How to create a passphrase

  1. Let your password manager do it

  2. Employ Diceware Passwords

    1. Diceware passwords are a method of generating a password by using a very large list of potential words and using a 6 sided die to randomly determine which words to use in your passphrase. 

    2. Reference:The Diceware Passphrase Home Page

    3. Reference:The Intercept - Passphrases That You Can Memorize

  3. Online tools

    1. Use a Passphrase

      1. This website will generate random passphrases four, five, and twelve words in length

      2. Keep generating until you find one you like

    2. There are several websites that will ask you to enter your passphrase to check its strength. You should be very careful about using websites like this, as they may log the passphrases and you cannot control what they do with the information once it has been entered it into their website.

Using Passphrases at Geneseo

At first glance using a passphrase seems incompatible with our Password Controls for Geneseo Accounts; however with just a few slight modifications you can use them for our services. Some options include capitalizing the a letter and adding a special character, or adding a number. Doing just two of those options does not hurt memorability and adds just a little bit more security while making it acceptable to our policy.

Passphrases and password managers

If you use a password manager it is not necessary to make all your passwords passphrases. In fact, on some sites in may be impossible due to them limiting the length of your password or not allowing dictionary words. But if you have one very good passphrase you use to access your password manager then you can use random strings of characters for all your passwords you do not need to remember, and only use passphrases when you need strong memorable passwords.

 

Still Need Help?

Ask CIT! 📞 (585) 245-5588 | 📧 Email | 💬 Chat | 📝 Submit a Request and we'll be happy to assist you.

 

Details

Details

Article ID: 1468
Created
Wed 6/3/26 2:21 PM
Modified
Fri 7/17/26 2:47 PM