How to make a password you can actually remember

Strength is a count of possibilities, written in bits

Entropy is log2 of the number of equally likely possibilities. Each bit doubles the attacker's work, which is why it is worth doing the arithmetic once instead of trusting a coloured bar.

Six words drawn independently from a list of 7,776 gives 7,776⁶ = 221,073,919,720,733,357,899,776 phrases, and log2 of that is 6 × 12.92 = 77.5 bits. Eight characters drawn from the 95 printable ASCII characters gives 95⁸ = 6,634,204,312,890,625, and log2 of that is 8 × 6.57 = 52.6 bits.

The gap is 25 bits, a factor of about 33 million. At a hundred billion guesses a second — the rate PHRASE assumes against a stolen fast hash — the eight characters fall in about nine hours, the six words in about thirty-five thousand years.

The formula assumes random, and a person choosing is not

Those numbers hold only if every possibility was equally likely. A person picking eight characters produces a word, a capital on the front, a digit and a punctuation mark on the end, and the attacker knows it.

Substituting 3 for e is the clearest case. SHADOWKEY's checker carries a function called deLeet that maps @ and 4 back to a, 3 to e, 1 and | to i, 0 to o, $ and 5 to s, then checks the result against a list of common passwords:

The middle column is the 52.6-bit calculation above, applied to a password that genuinely uses all four character classes. The right-hand column is what it is worth. The substitution added nothing, because it is a mechanical transformation of a known word and a cracking tool applies the same transformation to its own dictionary as a matter of course. One line of JavaScript on a static site undoes it.

Which is also why a passphrase has to be generated rather than composed. Six words you chose are not six words from 7,776; they are six words from the few hundred you reach for, in an order that makes sense.

Online guessing and the offline attack are different problems

At a login form the server counts. It can delay, lock the account, demand a second factor. A few thousand attempts is a lot, and almost any password outside the top ten thousand survives it.

The attack that sets the number of bits you need is the other one. A database leaks, the attacker has the stored hashes on their own hardware, and nothing rate-limits them. Their speed depends on how the password was stored, which you never chose. A single pass of SHA-256 or MD5 is fast by design, which is exactly wrong here: PHRASE quotes its crack times at 10¹¹ guesses a second against one of those, SHADOWKEY at 10¹⁰. A deliberately slow derivation is the opposite — KEYS turns a passphrase into a key with PBKDF2-HMAC-SHA256 over 600,000 rounds, so one guess costs 600,000 HMAC operations instead of one.

You learn which case applied when the breach is announced, years after choosing the password. Choose for the offline one. 77.5 bits is comfortable there; 52.6 is not.

Why the list has exactly 7,776 words

Five dice, six faces: 6⁵ = 7,776, so every outcome of five rolls maps to one word. The file is written that way. eff-large.txt on this site has 7,776 lines, the first reading 11111 abacus and the last 66666 zoom, and one word is log2(7776) = 12.92 bits.

That is what makes dice usable: you roll, and the software does a table lookup and nothing else, so there is no random source to trust. PHRASE has that mode, and refuses to look anything up if you type a character outside 1 to 6, because one dropped digit shifts every group of five after it.

Capitalising counts as zero bits, and the tools here say so

Tick "capitalise each word" and the phrase looks stronger. The number does not move, and KEYS prints the reason under the result: capitalising adds none, because it is not a choice made at random.

The mechanism is the definition. The box capitalises the first letter of every word, so for a given set of words there is exactly one capitalised form, and log2(1) = 0. It would only add something if the generator chose which words to capitalise. PHRASE shows the contrast with a case where the credit is real: its "add a digit" option picks at random which word gets a digit and which digit, so on a six-word phrase it adds log2(6) + log2(10) = 5.9 bits.

Where a passphrase is the wrong answer

A passphrase is long, which is the trick and also where it stops working. Six words with spaces runs past thirty characters, so a field that caps at sixteen, or truncates at twenty without saying so, removes the margin you were relying on. Where a manager holds the password you never type it, so memorability buys nothing and costs length: twenty random characters from a pool of ninety is about 130 bits.

The passphrase belongs to the one password that cannot live in a manager: the manager's own master password, a disk key, the passphrase on a backup. Memorised, attacked offline, never truncated.

What to use

PHRASE generates from the 7,776-word list, or looks up the words for dice you rolled, and states the strength in bits with the arithmetic beside it. SHADOWKEY checks one you already have. PWNCHECK answers a different question — whether that exact string is in a public breach corpus — by taking the SHA-1 in your browser, sending only the first five hex characters of the digest, and comparing the returned suffixes locally, so the service never sees the password or the whole hash. KEYS is the vault that makes the rest manageable, so that only one password has to be memorable.

What none of this tells you

Entropy is a property of the process that produced the password, not of the password. Generate six words, then press the button again because the first set looked silly, and you have thrown away part of the space; the 77.5 no longer applies.

No bit count sees reuse, and reuse is what loses accounts. PWNCHECK returning nothing means the string is not in that corpus, not that it is good. And a password of any length is irrelevant to a phishing page you typed it into, or a session token lifted after you logged in. A second factor covers those; arithmetic does not.