Memorised passphrases against generated passwords

There is a real trade-off here, and most coverage flattens it. A passphrase is usable because you can hold it in your head; a generated password is strong because nobody, including you, can. Those are not competing philosophies. They are two tools with two jobs, and the whole question is which accounts get which.

Memorise three, generate the rest

Memorise three or four passphrases. Generate everything else and store it in a password manager.

The passphrases cover what you need when you have no access to your tools: the manager’s own master password, your primary email, your computer login. The generated strings cover the other two hundred accounts, where being memorable has no value at all.

Why the memorable option exists

NCSC UK’s three-random-words guidance is not a compromise on strength. It is an acknowledgement that a rule people cannot follow produces worse outcomes than a rule they can. Faced with thirty complex strings to remember, people reuse one. Reuse is what turns a single breach into a cascade.

A phrase of three or four unrelated words gets length cheaply. Length is the property the current standard cares about. And crucially, you can type it into a locked laptop at six in the morning without a device in your hand.

Why the unmemorable option is stronger

A generated password has no structure for an attacker to model. It is not built from dictionary words, it is not derived from anything about you, and it can be far longer than anything you would agree to memorise — the standard requires verifiers to permit at least 64 characters.

It is also uniquely per-account by default, because there is no cost to you in having two hundred different ones when a manager is doing the remembering.

The cost is dependency. If you lose access to the manager, you lose access to everything it holds. That is exactly why the small memorised set has to exist alongside it.

There is a second, quieter advantage. Because you never type a generated password from memory, you are far more likely to notice when something is wrong: a manager that fills your credentials automatically on the real site will simply decline to fill them on a lookalike domain. That refusal is information. A phrase you know by heart offers no such signal, because you will happily type it anywhere.

Neither one is exempt from the length floor

The floors are the same whichever tool produced the password, and they depend only on whether a second factor is present. NIST sets 15 characters where the password stands alone and 8 where something else is also required. CISA’s consumer figure for a strong password is 16 characters, random and unique per account.

That is worth stating because the two options fail the test in opposite directions. Generated passwords are often left at whatever default length the tool suggested, which can be twelve. Passphrases are often three short words, which can also be twelve. In both cases the fix is the same and takes seconds: raise the slider, or add a word.

The old habit of padding to the minimum with a capital and a symbol is not a fix. NIST now prohibits verifiers from requiring those mixtures, and screening against breach and dictionary blocklists is what took their place.

Splitting your accounts between the two

• Memorise: password manager master password, primary email, device login. Three to four entries, each a passphrase of unrelated words, each at least 15 characters and ideally 16 or more.
• Generate and store: everything else, including banking, shopping, work tools and the dormant accounts you forgot you had.
• Never reuse across the boundary. The master password must not appear anywhere else, because it is the one credential that cannot be reset by anything you still control.
• Add a second factor to both categories. The 8-character floor only exists because a second factor is doing part of the work.

What people get wrong about making a phrase ‘complex’

The commonest mistake is treating a passphrase as a password that needs decorating. People take three words and then add a capital, a digit and an exclamation mark because a form told them to.

NCSC’s assessment of that instinct is direct: criminals know the substitution tricks, so the result ‘won’t be significantly stronger, but it will be harder for you to remember.’ And NIST now prohibits verifiers from requiring those mixtures at all.

The second mistake is picking words that mean something. A phrase built from your dog, your street and your birth year is not random; it is a summary of your public profile. NIST requires blocklists to include context-specific terms for exactly this reason.

If a phrase feels short, the fix is another word. Not another symbol.

Sources: NIST SP 800-63B-4, Digital Identity Guidelines · NCSC UK — three random words · CISA — four easy steps to stay safe online · NIST SP 800-63B-4 publication record

Reviewed 27 August 2026 by the CyberArtical editorial team against primary guidance from NIST, NCSC UK and CISA. Security guidance changes over time; where our earlier version of this page said something different, we say so in the article rather than editing it out quietly.