Passphrase vs Password: Which Should You Use?

Passwords and passphrases are both secrets you use to prove who you are, and both can be secure or weak depending on how they are made. The difference is not "one is safer." It is which one fits the way the credential will actually be stored and typed.

The two LeetTools generators cover both sides: the Password Generator produces random character strings, and the Passphrase Generator produces multi-word phrases. Each runs locally in your browser. This guide helps you choose between them.

The real difference: who has to remember it

A credential stored in a password manager can be a long random string that a human never needs to type. A credential you must recall and type—a master password, a device login, a recovery phrase—needs to survive human memory. That second constraint is what passphrases solve.

Compare the entropy honestly

Entropy measures how many guesses an attacker must try on average. Rough numbers:

• A random 16-character password from a 90-character pool: about 100 bits.
• A 4-word passphrase from a 2,434-word list: about 45 bits.
• A 5-word passphrase with capitalization and a number: about 64 bits.
• A 6-word passphrase with capitalization and a number: about 76 bits.

So a default 4-word passphrase is weaker than a default 16-character password. That is not a reason to avoid passphrases—it is a reason to give them enough words. Five or six words close most of the practical gap while keeping the phrase typeable, and for credentials that live in a human brain, a 6-word passphrase beats a "strong" password that ends up written on a sticky note.

Use a random password when a manager is involved

If the credential goes into a password manager, choose length over memorability. Set the Password Generator to 16 or more characters, enable all character sets the service accepts, and generate. The higher entropy costs you nothing because you never type it.

Use a passphrase when a human must remember it

For a master password, vault unlock, or local device login, use the Passphrase Generator with 5–6 words, capitalization, and a number or digit separator. Follow the memorable passphrase guide for the details and the numbers.

What not to do

• Do not reuse a passphrase or password across services, no matter how strong it is.
• Do not build passphrases from personal facts—pets, streets, birth years are guessable.
• Do not use published examples like "correct horse battery staple" as literal phrases; generate a fresh random combination.
• Do not store credentials in plain text files or browser notes that sync everywhere unless you accept that risk.

The decision in one sentence

Let the password manager hold long random strings, and let the human brain hold longer passphrases. Generate both locally: the Password Generator for manager-stored credentials, the Passphrase Generator for the ones you must remember, and the strong password guide for the reasoning behind each setting.