Yes - I didn't mean to imply passphrases are not good, I just meant that sufficient entropy is required no matter what you do. By the way, it's a bit easier to

Yes - I didn't mean to imply passphrases are not good, I just meant that sufficient entropy is required no matter what you do. By the way, it's a bit easier to discuss bits of entropy rather than number of possibilities. Assuming each possibility is equal (which is NOT true if you pick the password yourself, rather than randomly) then the entropy would be the logarithm of the no. of possibilities. Generally people use base 2, so: Random 12 digits alphanumeric: 71 bits of entropy Four common words: 30 bits of entropy Five words: 60 bits of entropy The multi-GPU cracker on the frontpage today would take 500,000 years to crack the 5 word password if it was stored via bcrypt (according to the article, which sadly did not specify the work factor). The four common words one, however, would fall in just four hours! P.S. It isn't actually hard to remember a complex password. Almost anybody can do it! The passphrase method is actually not dissimilar to the technique I use. Say the password started "OK53B3" (I just generated this in LastPass). OK, let's figure out a way to remember it. OK, I thought of a way to remember the first two letters ;) 53.. 54 cards in a deck with the jokers, so we've lost a joker. "OK, guys, we've lost a joker" "B3" sounds like someone with a few missing teeth saying "be free!" so I'm imagining a toddler throwing the joker out of the window going "be thfree!" Very rapidly this will shortern as your memory of it strengthens with repetition (if you're entering this password every day - I recommend using a password manager so you have just one secure password you enter every day). After a few days it will be "OK missing joker be three" etc then just the password itself. After a bit longer it just becomes muscle memory - I couldn't actually recite it easily anymore, but I type it in seconds. The important thing though from an entropy perspective is that whether you are making a story for your passphrase or for your password, the story comes second. Generate the password / passphrase and then create a story, this assures that each possibility is equal as I mentioned earlier (if they are unequal, there is less entropy). Of course, I recognise that even with a good memorisation technique, passphrases still beat out f%8D( from a learning curve, ease of use, and accessibility standpoint. The reason I've stuck with the ugly and relatively short passwords is purely so I can type them in as fast as possible!