In general, a word is more random than its first letter or a random letter, but letter-based passwords can be an effective method of password generation if the phrase used is sufficiently random or unique.
Let's assume the password cracker knows how your password is generated. Sure, this is a worst-case scenario, but password crackers are surprisingly sophisticated so this is IMHO the best way to judge the true strength of your password.
Picking a phrase off the top of your head is dangerous. Phrases are just as susceptible as other types of passwords to being shockingly easy to guess if you pick the first thing that comes to mind, and as shown below, even randomly-chosen natural English phrases are only half as complex as randomly chosen words. Any good password generation scheme will have you avoid using the same password as other people. There are phrase passwords like "trustno1", "iloveyou", or "letmein" that are extremely common. This paper and this one both show why picking phrases off the top of your head often goes poorly. In their research a large number of these passwords can be cracked using just a few thousand or million phrases. Secure password generation schemes randomly pick one of quadrillions or more possibilities, not just the most convenient of several thousand possibilities.
Password complexity is typically judged using entropy, measured in bits. If all possibilities are equally likely, a password with an entropy of 50 bits will take up to 2^50 tries to guess. We'll use the estimates for entropy explained below to compare some schemes:
For 15 characters,
- If chosen randomly from the 26 letters of the alphabet, numbers, periods, and commas, you get a complexity of 5.2*15 = 78 bits
- If chosen randomly from the 26 letters of the alphabet, you get a complexity of 4.7*15 = 70.5 bits
- If chosen from the first letters of random words, you get a complexity of 4.17*15 = 63 bits
In comparison, for 7 words:
- If chosen based on one of the first phrases that comes to mind: don't do this. At best you'd get maybe 40 bits of entropy, guessing based on the papers referenced above. At worst you'd pick "letmein" and your account could be hacked even without using cracking programs.
- If we choose a 7-word phrase randomly from a large body of text: between 39 and 52 bits
- If we chose words randomly from a small dictionary of 1000 words (which would cover 79% of an average text): 70 bits of entropy
- If we chose words randomly from a large dictionary of 8000 words (covering 96.3% of a text): 91 bits of entropy
So in summary, 15 characters is usually more secure than a 7-word phrase, but it depends on how you generate each, and assumes you're not choosing something common. Additionally, some researchers like C. Kuo feel that mnemonic passowrds like these are good ideas. She said, "Mnemonic phrase-based passwords are not as strong as people may believe, but that does not mean that we should refrain from using them… the space of possible phrases is extraordinarily large, and building a comprehensive dictionary is not a trivial task. There are also more permutations that can be made on mnemonic phrases [e.g. love can become "<3"], increasing the size of the search space. It may be possible to crack a significant percentage of mnemonic passwords in theory — but this is different from today's reality."
How we get these entropy figures:
Estimating the entropy of natural English is tricky because it depends not only on the body of text you're using as a baseline, but it also depends on how you count word, punctuation, and spacing, as well as what your method of statistical analysis is. Estimates for the entropy of a single character can be as low as 1.25 and as high as 1.77 (based on research summarized here). One estimate I saw for entire words in a phrase was 5.97 bits of entropy, which seems low based on the fact that each word is on between 4.25 to 5.1 characters long. We'll assume based on this information that the entropy is between 5.5 to 7.5 bits per word when using randomly chosen phrases.
A random character from the 26-character alphabet has an entropy of -log2(1/26), or 4.7 bits/character. Throwing in commas, periods, and ten numbers would raise this to -log2(1/38) = 5.2 bits/character. The first letters of a word might appear significantly less random, but looking at their frequency (assuming each word is independently chosen), the first letters have an entropy of 4.1 bits/character.
Note: Applying these entropy statistics from general English to a password search space is not a perfect application and is further discussed here.