Why a Passphrase of Random Words Can Beat Random Characters

Where the idea comes from

Diceware, developed in 1995 and later popularized by the Electronic Frontier Foundation, generates passwords by rolling physical dice to select words from a large numbered word list — hence the name. The underlying insight, illustrated famously in an XKCD comic, is that a sequence of several random common words can carry more entropy than a much harder-to-remember string of random characters, while being genuinely easier for a human being to memorize and type correctly.

The entropy math behind it

Entropy from a word-based passphrase is (number of words) × log₂(wordlist size). The official EFF Diceware list has 7,776 words (6⁵, matching five dice rolls), giving about 12.9 bits per word — so a six-word passphrase carries roughly 77 bits of entropy, comparable to a long random-character password, but built from words a person can actually recall.

Why memorability isn't just a nice-to-have

A password too awkward to remember gets written on a sticky note, reused across accounts, or set to something predictable out of frustration — all of which undermine security far more than a slightly lower theoretical entropy score would. A passphrase that's actually usable, and therefore actually used correctly, is a meaningfully better real-world outcome than a stronger-looking password nobody can keep straight.

Try it yourself

Our Diceware Passphrase Generator builds a random word-based passphrase using your browser's cryptographically secure randomness, with an honest entropy estimate for its own wordlist size.