The Diceware & Passphrase Revolution
For decades, users were told to create passwords like Tr0ub4dor&3. Humans struggled to memorize these convoluted strings, leading to sticky notes on monitors and password reuse. Worse, automated cracking software can crack short mutated strings in a matter of hours.
In contrast, a 4-word random passphrase like correct-horse-battery-staple (popularized by XKCD and formalized by the Electronic Frontier Foundation (EFF) Diceware Project) spans 28 characters. It is completely trivial for a human to visualize, yet would take an attacker billions of years to exhaustively brute-force.
Why Word Count Determines Security
When each word is chosen from a curated list of 1,000+ distinct words:
- 3 Words: ~38 bits of entropy (Convenient for low-risk PINs)
- 4 Words: ~52 bits of entropy + digits = ~65 bits (Strong consumer defense)
- 5 Words: ~65 bits of entropy + digits = ~78 bits (Enterprise standard)
- 6 Words: ~78 bits of entropy + digits = ~92 bits (Master vault level)