We all know that passwords should not only be randomly generated, but also look random. The reason is that attackers can use patterns or existing words to be able to bruteforce the passwords faster, so a randomly generated password that (by pure chance) looks like wwwtroy31 is less secure than a randomly generated password like 2ug9wf4v. The question is: should the same reasoning apply to passphrases? How? What should a secure passphrase look like? What kind of passphrases should be discarded, even if we generate them completely randomly?

  • a sequence of randomly generated passwords separated with spaces, but who accept to handle it ? maybe someone from Marvel's characters. – elsadek Jan 19 '19 at 17:02
  • It's very hard to say what a secure passphrase looks like, however here are a couple links with info to a good method en.wikipedia.org/wiki/Diceware eff.org/dice – they Jan 19 '19 at 20:33

The concern is perfectly valid for short passwords like a PIN for a payment card. If you generate a random four digit PIN, you have a 0.01% chance of generating “1234”, a 0.05% chance of generating “flush“ in format n & (n + 1) & (n + 2) & (n + 3)*, a 0.07% chance of generating “reverse flush” (n & (n - 1) & (n - 2) & (n - 3)*), a 0.1 % chance of generating a PIN that has all digits the same and so on. Maybe those probabilities are low, but they are still non-negligible and when you sum all of them (and ideally add some other undesired patterns), the likelihood of having one increases.

Adding some rules for PIN generation is a bit tricky, however. If you are too eager to reduce the PIN space, then the attackers also have a smaller set of potential PINs to try.

The longer the password is, the less this is a real threat. For a 6 character password (^[a-zZ-Z0-9]{6}$, uniformly distributed), generating passwords like “123456” is rather unlikely (but still somewhat plausible). When you generate a password using 128 bits of entropy, the probability that you will happen to generate an obvious password that crackers would guess is almost zero.

The same applies for passphrases, except that entropy estimation is harder for passphrases than for random passwords.

* The “&” operator is string concatenation.

  • 1
    Note: Information theory entropy is defined for processes, not individual outcomes. The formula to calculate Shannon entropy is based exclusively on the statistical distribution you use to describe such a process. In the context of passwords, entropy measures how good your password generation process is. Not how good a user's password is. It is equally impossible to estimate entropy of a single password or passphrase because a sample size of one doesn't tell you anything. The entropy of a ideal random string generator is trivial to calculate. (Equally so for both password and passphrases.) – Future Security Jan 20 '19 at 3:14
  • When people say passwords have entropy it's either a misunderstanding or shorthand. It's fine to say "The password 'qwerty1234' has an estimated [number] bit strength" if you're just concerned with how good one of your passwords is. – Future Security Jan 20 '19 at 3:24
  • In my case, it is rather shorthand, so I have accepted your suggestion (+ added few other modifications). I also sometimes use it as an estimate for attacker chances: “n-bit entropy password” for “a password as strong (usually according to lower-bound estimate) as a fully random password generated with n bits of entropy”. – v6ak Jan 20 '19 at 12:09

Discard a passphrase if:

  • It appears in a previous breach, e.g. you could use the haveibeenpwned k-anonymity API to check against millions of previously leaked passwords.
  • It is so short it can be brute-forced, e.g. "i do a is me" is only 12 lowercase-only characters which is really pushing it for length.
  • It has obvious patterns or repeats, e.g. "password 123 password 123 password" would probably be a bad passphrase.
  • It's a song lyric or Bible verse or famous quote. Don't search the Internet for this obviously, work from a local database or your memory.
  • You're going to mistype it a lot because of an exceptionally obscure or hard-to-spell word or something.

That's all I could think of. Short answer: yes, the logic still applies in theory. It's unlikely to come up in practice though.


Yes I know the question is "passphrase", but I need to ease in.

Much of the password "Best Practice" promulgated for years is not only of dubious value, it's positively bad. Standard checkbox security requires things like:

15 characters, upper case, lower case, numbers, special characters, no repeats, no patterns, squirrel noises and moose calls

Ironically as the length and complexity grows, human nature and memory results in writing down the complex passwords, creating more narrow memory patterns, and re-using the ugly things once you finally remember them. Re-use is especially bad. Sticky notes with impossible phone numbers corresponding to letters and numbers are quite common.

This is all aimed at defending against high speed dictionary variant attacks. In most cases, this is the wrong threat vector. Remote attacks, online attacks, should be simply blocked after a handful of failures. It doesn't take 15 characters of rutting sounds, simply avoiding the top 100 poor ones like password and 123456.

Many corporate and government security entities run crackers against your password hashes in their domain servers and declare your password bad if they break it after weeks of high speed attacks. Seriously? If attackers are in your network running high speed attacks, password complexity is the least of your problems.

Now on to passphrases.

Again, consider the intended purpose. If it's for remote login, the same block after 5 or so failures applies and complexity is of little concern.

The real concern is direct attack. Usually passphrases are used for drive/file encryption. If your file or drive is subject to attack, then complexity and attack speed come into play.

Classic analysis might assume English words where a 50,000 word dictionary would be 90% coverage. An unknown length with a strong probability of 3 to 10 words. Most likely a proper sentence following grammar rules would dramatically trim the probability down to something very difficult but not improbable.

However, statistics alone don't tell the full story. The encryption implementation comes into play as well. If the hash round count is large enough (I think Veracrypt is around a million), then each brute force attempt takes a long time. It no longer becomes practical to high speed crack. Veracrypt even allows you to define an alternate secret round count, so now you have many thousands of possibilities of those as well.

So while it can be mathematically argued that 90% of English language passphrases can be iterated through in an acceptable time period, verifying that you have the right one when each wrong verification takes a significant chunk of time precludes this as a viable attack.

Avoid common phrases, throw in some non-dictionary and you're probably solid.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.