How to Create a Strong Password: 6-Word Passphrase (Diceware)

"Tr0ub4dor&3" looks complicated, but it follows a pattern every password-cracking tool knows: a common word, letters swapped for numbers, a symbol at the end. Meanwhile "horse-battery-staple-cloud-pedal-sundae" looks like a joke and is far harder to guess. The difference lies in how the password was chosen, not in how many symbols it has.

Why a password with symbols and numbers is not strong

Humans are predictable when forced to meet complexity rules: capital first letter, "a" becomes "@", a number at the end, an "!" to close. People who crack passwords know this and try those variations first. The result is a password that is hard to remember and easy to guess.

Official guidance changed because of this. NIST, the US standards agency, now prioritizes length over composition rules in its digital identity guidelines (SP 800-63B, revision 4, 2025): accept long passwords (at least 64 characters), block passwords that already appeared in breaches and do not force periodic changes without reason. Check the current text on NIST's site before adopting specific numbers in a corporate policy.

What a passphrase is and what Diceware is

What is a passphrase?

A passphrase is a password made of several randomly drawn words, like "horse-battery-staple-cloud-pedal-sundae". It is long, easy to type and easy to memorize, and its strength comes from the random draw, not visual complexity.

What is Diceware?

Diceware is a method, created by Arnold Reinhold in 1995, for drawing words from a list using ordinary six-sided dice. Each word takes 5 dice rolls, forming a number from 11111 to 66666. That number points to a word in a list of 7,776 entries (6 to the 5th power). The most popular list today is the EFF "large wordlist", published in 2016, which avoids symbols and rare or hard-to-spell words.

What each word is worth: the math

With a 7,776-word list, each drawn word adds about 12.9 bits of entropy. Six words give roughly 77 bits, meaning 7,776⁶ ≈ 2.2 × 10²³ possible combinations. For comparison, an 8-character password of truly random characters from ~94 printable symbols has about 52 bits.

• 8 random characters (~94 symbols): ≈ 6 × 10¹⁵ combinations. At 1 trillion guesses per second (fast-hash scenario with dedicated hardware), exhausting them takes under two hours.
• 6 Diceware words: ≈ 2.2 × 10²³ combinations. At the same speed, it takes thousands of years to sweep the whole space.

These numbers are simple calculations done here, not measurements of a real attack. They show the order of magnitude. The point is that each extra word multiplies the attacker's work by almost 8,000.

How to create your passphrase in 5 steps

1. Get the list. Download the EFF large wordlist (a text file with 7,776 lines, a 5-digit number + a word).
2. Roll five dice. Write the five numbers in order, for example 4-2-6-1-3 → 42613.
3. Look up the number in the list and write down the matching word.
4. Repeat until you have 6 words. For a password manager's master password, 6 is a good level; for lower-risk uses, 5 may be enough.
5. Type it from memory for a few days until it sticks. Don't swap words "because it looks odd": hand-picking destroys the draw and the math above no longer holds.

No dice at hand? The passphrase generator in Bitwarden draws the words for you with the program's own random generator. It is less hands-on than dice, but far better than making one up in your head.

Where to use a passphrase (and where not)

You can only memorize a few passphrases. Use them where you must type from memory:

• Password manager master password — the main use.
• Computer login and disk encryption (for example, the BitLocker PIN/password).
• Your main email account, which is the recovery door for all others.

For everything else (each site, each app), let the manager generate a unique random password and forget it. Reusing passwords is what feeds credential stuffing, and an excellent passphrase repeated across ten sites is still a compromised password the day one of them leaks.

What a passphrase does not solve

A long password doesn't protect against everything. If you type the passphrase into a phishing page, the attacker gets the whole thing, long or short. If an infostealer is on your computer, it captures what you type. And an attacker who tries a few common passwords against many accounts, as in password spraying, fails against randomly drawn passwords but catches anyone still using "Company@2026".

That's why a passphrase is the foundation, not the finish line. Add two-factor authentication (see the step-by-step for 2FA with TOTP) and, where supported, passkeys. Also check whether your email has appeared in breaches with the Have I Been Pwned guide: if an old password of yours leaked, change it even if it looks strong.

Practical summary

• A strong password is long and randomly drawn, not stuffed with symbols you picked.
• 6 Diceware words ≈ 77 bits of entropy; each extra word multiplies the attacker's effort by ~7,776.
• Memorize at most 2 or 3 passphrases (manager, computer, main email); everything else goes in the password vault.
• Never reuse passwords, and enable 2FA on everything that matters.

If you want the next step after passwords, read the post on passkeys and passwordless authentication, which explains why in the future you may need to memorize far less.

Sources consulted

• NIST, SP 800-63B (Digital Identity Guidelines, Authentication and Authenticator Management), revision 4
• EFF, "Deep Dive: EFF's New Wordlists for Random Passphrases" (2016) and the eff_large_wordlist.txt list
• Arnold G. Reinhold, Diceware method (1995)