Passphrases Beat Passwords: Entropy, Cracking Math, and Memorability

Why four random words outperform complex gibberish, how password entropy is calculated, and how to generate both correctly.

KPM Editorial · Security · 2025-09-18 · 6 min read

Complexity Rules Are Mostly Theater

"Must contain uppercase, a number, and a symbol" produces passwords like P@ssw0rd2024! — hard for humans, trivial for machines that try exactly these substitutions. What actually matters is entropy: the number of random bits behind your secret.

Entropy in 60 Seconds

Entropy = length × log₂(alphabet size). A 12-character password from 94 symbols carries ~79 bits. Four random words from a 7,776-word list carry ~51 bits — less on paper, but attackers crack patterns, not math. Dictionary attacks shred human "cleverness" while truly random passphrases resist them.

Why Passphrases Win in Practice

• Memorable: "correct horse battery staple" sticks; "J7#kL9!qZ2@x" does not.
• Typeable: fewer shift-key gymnastics means fewer lockouts and sticky notes.
• Long by default: length defeats brute force faster than symbol variety.

Generation Rules That Matter

1. Use a cryptographic random source (Web Crypto's getRandomValues), never Math.random().
2. Generate on your own device — never let a website "remember" your password.
3. Unique per site, stored in a password manager. Your brain holds one master passphrase; the manager holds the rest.

Do It Right, Locally

KPM's Password Generator uses the Web Crypto API in your browser to build high-entropy passwords and passphrases. Nothing is transmitted or stored — generate, copy, and paste into your manager.