How long should a passphrase be?

Length is the one thing about a passphrase you can count, so it is the first thing to get right. The right number depends on one question: can an attacker guess as fast as their computer allows, or does something slow them down?

Bits: the unit that matters

A passphrase made of random words has a size you can calculate. Pick each word at random from a list of 2,048 and every word has 2,048 possible values. That is 2 to the power of 11, so each word is worth 11 bits. Each bit doubles the number of guesses an attacker needs, so two extra words make the job about 4,000 times harder.

This only works when the words are chosen by chance. The passphrase generator uses the 2,048-word English list and your browser’s secure random number generator, so each word really does carry 11 bits.

What each length is worth

On average an attacker finds the answer after trying half of all possibilities. The table uses the same assumption as the generator’s strength line: ten billion guesses a second, which is what a well-equipped attacker can manage against a stolen file protected by a fast hash.

Words	Bits	Time to try half of all options
3	33	under a second
4	44	about 15 minutes
5	55	about 21 days
6	66	about 117 years
7	77	about 239,000 years
8	88	about 490 million years

Those figures are worst cases, with the attacker guessing at full speed. Real situations are usually kinder, and that is where the two kinds of attack come in.

Online and offline attacks

Online means guessing against a live service. The service can limit attempts, add delays and lock the account, so an attacker might manage a few guesses per second. At 100 guesses a second, even a 5-word phrase would take millions of years to cover half its options. For an account, 5 or 6 words is plenty.

Offline means the attacker has a copy of something they can test without anyone watching: a stolen password database, or an encrypted file. Nothing limits their speed except hardware. This is the case the table describes, and the reason a file’s passphrase should be longer than an account’s.

What a slow key derivation changes

Good software does not use your passphrase directly. It runs it through a deliberately slow function, called a key derivation function, that turns it into the real encryption key. Argon2id, described in RFC 9106, is built to be slow and to demand a lot of memory, which blunts the speed advantage of specialized hardware. Silo uses Argon2id when it turns a PIN or passphrase into a key.

If each guess is made 1,000 times more expensive, that is worth roughly 10 extra bits. It buys time, but it is not a substitute for length. You can’t see how a given program has set it up, and your passphrase may need to last for years, so treat the slow function as a safety margin, not a plan. The generator’s strength line does not assume one.

What to choose

• Online accounts: 5 or 6 words. Services limit guessing, and a password manager can hold the phrase. NIST’s guidance favors length and a check against lists of known-bad passwords over rules about symbols.
• A key that protects files: 7 or more words. Offline guessing is the realistic threat, so aim for at least 77 bits, and 8 words if you can remember them.
• A phone unlock: ask what the phone limits. Phones cap attempts and add delays, which is why a shorter code can be acceptable there. See the comparison of PIN, pattern, passphrase and face unlock for how to choose.

Making a long phrase stick

Read the words aloud, make a quick picture of them in order, and type the phrase from memory a few times in the first week. Keep a written copy somewhere safe until you are sure. Don’t swap a word you dislike for one you prefer: that edit removes the randomness. Press Make new ones instead.

When to go longer

Add words when the secret protects something that will matter for a long time, when it cannot be changed easily, or when you will never type it again after setup and can keep it in a manager. The extra cost is a few seconds of typing, once.