Strong Passwords You Can Remember: What Official Guidance Says About Passphrases

Official guidance favors long, random passwords over symbol-heavy rules, and a passphrase of random words is the usual method for the few secrets a person must memorize. For everything else, agencies point to password managers, multifactor authentication and passkeys. The evidence on memorability is thinner than the guidance suggests.

The best-supported answer is to build a memorable password from several words chosen at random, not from symbols, capital letters and a trailing digit. Government and nonprofit guidance in the United States and the United Kingdom converges on length, randomness and uniqueness as the qualities that matter. The same guidance also concedes a limit: nobody can memorize dozens of strong, unique secrets.

That limit shapes the whole question. A person can reasonably memorize a few strong secrets, such as a password-manager master passphrase, a computer or phone login, and perhaps a primary email account. For every other account, the Cybersecurity and Infrastructure Security Agency (CISA) advises letting a password manager generate and store long, random, unique passwords.

The stakes are practical. Verizon's Data Breach Investigations Report (DBIR), a yearly tally of incidents the company and its contributors see, has repeatedly listed stolen or reused credentials among the leading ways attackers get into organizations. Its 2026 edition shows a lower share than 2025, but a change in how incidents are classified explains part of that drop.

Strength comes from length, randomness and uniqueness

CISA's guidance describes strong passwords as long, random and unique. That framing replaces an older folk wisdom in which a password earned points for mixing uppercase letters, digits and punctuation. The older rules proved easy to satisfy in predictable ways.

The US benchmark is NIST Special Publication 800-63B-4, the National Institute of Standards and Technology's revised digital identity guidelines, finalized in 2025 and replacing the 2020 edition. Secondary sources disagree on the exact date: one vendor blog says July 31, 2025, while another site says August 26, 2025. The document is addressed to organizations that run login systems, so it works here as a proxy for what good practice looks like, not as personal instructions.

According to summaries of the standard from Angelforce and Secureframe, a service that relies on a password as the only login factor must require at least 15 characters. If the password is one factor within multifactor authentication (MFA), the floor drops to 8. Services must accept passwords of at least 64 characters. Both are compliance and vendor summaries, not the NIST text itself, though they agree with each other on these numbers.

What the standard stops requiring

Per the Angelforce summary, services must not impose composition rules such as one capital, one digit and one symbol. A separate vendor, TechCompare, offers the reasoning: most people capitalize the first letter and put the digit at the end, so the rules generate predictable patterns. That explanation is the vendor's paraphrase, not NIST's own wording.

The same summary says scheduled rotation is out. Forced changes only help once a password has leaked, so NIST ties changes to evidence of compromise instead of the calendar. Services are also expected to screen new passwords against lists of common and breached ones, to allow password managers and autofill, and to allow pasting.

Length alone is not the whole story. A 15-character count says nothing about randomness: a string like Password1234567 meets the floor but would be rejected by a blocklist, which is why length is paired with screening. The Electronic Frontier Foundation (EFF), a nonprofit, adds that computers are fast enough to guess passwords under about ten characters, so even fully random short ones may be too weak where an attacker can try unlimited guesses.

Passphrases: how many words, and who picks them

Recommendations on word count differ, and the reason lies in the kind of attack each body has in mind. In an online attack, the guesser works through the login page, where a service can rate-limit or lock out. In an offline attack, the guesser holds a stolen file of password hashes and tries guesses at machine speed.

Three, four or six words

The UK's National Cyber Security Centre (NCSC) advises home users to build passwords from three random words. It warns against easily guessed combinations such as onetwothree and against words tied to the user personally, like family members or pets. Its rationale notes that sites salt stored passwords, which together with three random words gives a reasonable degree of protection. That reasoning concerns online-attack scenarios and sound storage; it is not a guarantee against offline cracking of poorly stored hashes. The NCSC itself calls the method not a panacea but better than arbitrary complexity rules, according to a NetSec.News account of its guidance.

CISA sets the bar higher, describing a passphrase as four or more random words. EFF goes further still: for most applications it suggests six words drawn from its long wordlist. EFF's long list has 7,776 words, one for each result of five dice. Its short lists have 1,296 words each, for four dice, and the organization says short-list phrases may be easier to remember and type but give less strength per word.

The table below shows what those list sizes imply. The figures are Jaroha's own arithmetic, calculated as the number of words multiplied by the base-2 logarithm of the list size. They are not a published table, and they apply only when dice or software pick the words.

Read against that arithmetic, the disagreement among agencies looks less like a contradiction and more like different risk tolerances. Three words from the long list come to about 39 bits, which is plausibly adequate only where login attempts are limited and storage is sound. That reading is Jaroha's inference; none of the sources reviewed states it directly. Six words, at about 77.5 bits, give far more headroom against a stolen hash file.

EFF's list designer, Joseph Bonneau, wrote in a 2016 post that the security of a passphrase generated from either list is identical, with the differences lying in usability. That holds only for lists of equal size, and he added that more study is needed to determine which list yields phrases that are easier to remember.

The words must not be the user's favorites

The entropy numbers collapse if a person chooses the words. Phrases drawn from songs, quotations or personal lists can be far weaker than the table implies. An arXiv preprint on long passphrases, not confirmed as peer reviewed, makes a related point: resemblance to natural language may help usability, but it shrinks the theoretically huge search space and makes an attacker's job easier.

The brief behind this article found no peer-reviewed guessing study to quantify how weak human-picked word phrases are. The warning rests on guidance and on that preprint, so it is better treated as a strong caution than as a measured effect.

Are passphrases actually easier to remember?

The intuition that several ordinary words beat a jumble of characters is common, and the research is more mixed than the intuition. A 2007 field study by Keith, Shao and Steinbart, published in the International Journal of Human-Computer Studies, is one of the better-known examples. An aggregator summary of it, which is weak and was not checked against the paper, reports 1,311 login attempts by 56 participants over 10 weeks. According to that summary, passphrases did not produce more recall failures than simple or stringent passwords, yet participants rated them less favorably on ease of use than stringent passwords.

One caveat limits what that study can say about security: its passphrases were chosen by the participants, not assigned at random. Its results therefore do not transfer to the randomly generated phrases that official guidance recommends.

A usability study of system-assigned passphrases is described in an indexing summary from Semantic Scholar. It says assigned passphrases performed similarly to assigned passwords of comparable entropy on usability measures, and that shrinking the dictionary, using fewer words or letting users reorder them did not appear to help. The author list was not visible in the summary, so the paper should be located before it is relied on. The implication is that passphrases are not a free memorability win at equal strength; their appeal is that the same strength can be reached with fewer, more familiar chunks.

A 2022 paper in Information & Computer Security concludes, in its abstract, that passphrases overall better support users on security, memory and typing issues. Only the abstract was available, and sample details were not confirmed. A literature excerpt from the same paper on ResearchGate adds two competing points: typographical errors are a usability problem for passphrases, while long passphrases often impose less cognitive load.

How advice is delivered also appears to matter. A Springer study of password guidelines reports that users given persuasive text and sample creation methods made stronger passwords than users given strict composition rules. Only a summary was visible, so details such as sample size and effect size are unknown.

Taken together, the studies are small and short, often rely on convenience samples, and rarely measure memory over months. The fair reading is that passphrases are at least comparable to other passwords for recall, with some typing and ease-of-use costs, not that they have been proven easier.

Memorize a few secrets, delegate the rest

A recurring theme in official guidance is that remembering every password is not practical. CISA says a password manager lets a person remember one strong master password while the software handles the rest. The NCSC goes a step further, according to the NetSec.News summary: random passwords generated by a manager are stronger than either three random words or human-made complex passwords, and the three-word method is suggested for the master password. For most accounts, then, a memorable password is the second-best option.

Uniqueness is the other benefit. Credential stuffing is the automated replay of leaked username and password pairs on other sites, and it works only when people reuse passwords. A manager that creates a different password for every account limits the damage from any single leak. The brief found no outcome study that quantifies that benefit, so the size of the effect remains unmeasured.

MFA and passkeys

A strong password does not stop phishing, in which a victim is tricked into handing it over. An iTecs summary of NIST's guidance says passwords are not phishing-resistant, so MFA and stronger authenticators remain necessary. CISA advises pairing passwords with MFA and, for organizations, phishing-resistant MFA.

Passkeys, which replace the typed secret altogether, are gaining official attention. A summary from Optro says the NIST revision formally recognizes synced passkeys at one assurance level, and the NCSC's three-random-words page now carries a banner that reads, in the agency's words, that passkeys are the future. A Bitwarden page, from a password-manager vendor, says the NCSC now prioritizes passkeys where they are supported. Primary data on passkey adoption and effectiveness was not retrieved, so the strength of that shift is hard to judge.

One dissenting view surfaces in the introduction of the arXiv preprint, which attributes to other authors the concern that high-risk accounts should not be held in a password manager. That position conflicts with CISA and NCSC advice and was not verified, so it is a minority view and not a finding. No data on password-manager breaches, or on how well master passphrases hold up, was found either.

How much risk stolen credentials carry

Verizon's 2025 DBIR found credential abuse was the leading initial-access vector at 22% of breaches, just ahead of vulnerability exploitation at 20%, according to slides of the report hosted by New York State. Verizon's companion article on credential stuffing repeats the 22% figure. The same article reports that in single sign-on provider logs, credential stuffing made up a median of 19% of all daily authentication attempts, reaching 25% at enterprise-sized companies and 12% at small businesses, from a sample of 2,301. These are company logins, not consumer accounts.

The 2026 edition, as reported by Infosecurity Magazine, flipped the order: vulnerability exploitation rose to 31% from 20%, and credential abuse fell from 22% to 13%. A security-vendor analysis from Push Security adds a caveat. The 2026 report introduced pretexting as its own vector, which reclassified some incidents; under the old definition, credential abuse would have been 16%. The four tracked vectors together account for only 66% of initial access.

Push Security also reports that credential abuse appeared in 39% of breaches when the whole attack chain is considered, and a second vendor, Abnormal, repeats that figure. Both rest on the Verizon report, so they are not independent confirmation, and the 2026 PDF excerpt reviewed was too fragmentary to verify it directly. A reasonable interpretation is that the 22% to 13% drop reflects, at least in part, a change in how incidents are counted, not proof that credentials matter less.

Weak credentials also linger. In the 2026 findings as reported by Infosecurity Magazine, resolving 50% of findings on weak passwords and permission misconfigurations at third-party organizations took almost eight months. That is an organizational finding and says little about how individuals behave. The DBIR is also a convenience sample of incidents Verizon and its contributors see, not a census of all breaches.

What it adds up to, and what to watch

The durable finding is that length and randomness beat decoration. A handful of words picked by dice or software offers a defensible balance for the few secrets that must live in memory, with four to six words a sturdier target than three where an attacker could ever hold a stolen hash file. Confidence in that conclusion is moderate, because the guidance conflicts on word count and the strength figures are arithmetic, not empirical results.

Everything else points away from memory. Managers, MFA and passkeys carry the load that no human can, and the open questions are about how well they hold up in practice. Readers following this field should watch for primary NIST confirmation of the details now relayed through vendors, independent passkey data, and long-term studies that finally measure how well people remember what they are told to memorize.

Frequently asked questions

How long should a password be?

According to summaries of NIST SP 800-63B-4, a service that uses a password as the only login factor must require at least 15 characters, and 8 is the floor when the password is one factor within MFA. Services must also accept at least 64 characters. These details come from secondary summaries, not the NIST text.

How many words should a passphrase have?

Guidance differs. The UK NCSC suggests three random words, CISA describes four or more, and EFF suggests six from its long wordlist for most uses. The gap largely reflects whether the main worry is throttled online guessing or offline cracking of a stolen hash file.

Do symbols and capital letters make a password stronger?

Not reliably. NIST's current guidance, as summarized by Angelforce, bars services from requiring mixtures of character types. A vendor summary explains that such rules push people toward predictable patterns, such as a capital first letter and a digit at the end.

Should a memorable password be used for every account?

CISA and the NCSC both point to a password manager for most accounts, since manager-generated random passwords are stronger than anything a person can memorize. Memorized passphrases are mainly recommended for the few secrets that must be remembered, such as the manager's master password.

Is a passphrase enough to stop account takeover?

No. Passwords of any strength are not phishing-resistant, according to a summary of NIST's guidance, which is why CISA advises pairing them with MFA. Passkeys are also receiving official attention where services support them.

Sources

1. Good Security Habits , CISA
2. Cyb3R_Sm@rT!: Use a Password Manager to Create and “Remember” Strong Passwords , CISA
3. Require Strong Passwords , CISA
4. Require Strong Passwords in Government , CISA
5. EFF Dice-Generated Passphrases , Electronic Frontier Foundation
6. Diceware “Passphrase”? What’s that? , Electronic Frontier Foundation (2025-08-19)
7. EFF's New Wordlists for Random Passphrases , Electronic Frontier Foundation (2016-07-01)
8. Three random words or #thinkrandom , UK National Cyber Security Centre
9. NCSC Recommends Against Arbitrary Password Complexity Requirements , NetSec.News
10. NCSC guidance on passwords: what it recommends and where a password manager fills the gap , Bitwarden
11. Passwords and passkeys - what NIST SP 800-63B-4 recommends , Angelforce
12. Best Password Practices for 2026: Latest NIST Guidelines, Policy Template + Checklist , Secureframe
13. NIST Changed the Rules on Passwords: Is Your Organization Still Following Outdated Guidance? , CyberUnit
14. NIST Password Guidelines (SP 800-63B-4) in Plain English , BestPasswordGenerator.io
15. NIST Password Rules: 15-Character Minimum - TechCompare , TechCompare
16. NIST SP 800-63B-4 Password Guidelines for Businesses , iTecs
17. NIST password guidelines , Optro
18. 2025 Data Breach Investigations Report (slides) , Verizon, hosted by New York State ITS (2025-06-01)
19. 2025 DBIR: Credential Stuffing Attack Research & Statistics , Verizon (2025-01-01)
20. Verizon DBIR: Vulnerability Exploits Overtake Credentials , Infosecurity Magazine (2026-01-01)
21. What the Verizon DBIR tells us about breaches in 2026 , Push Security (2026-01-01)
22. 62% of Breaches Involved the Human Element: Key Takeaways From Verizon 2026 DBIR , Abnormal (2026-01-01)
23. The usability of passphrases for authentication: An empirical field study , International Journal of Human-Computer Studies (2007-01-01)
24. (PDF) The usability of passphrases for authentication: An empirical field study , Academia.edu
25. [PDF] The usability of passphrases for authentication: An empirical field study , Semantic Scholar
26. Usability of the login authentication process: passphrases and passwords , Information & Computer Security (Emerald) (2022-01-01)
27. Usability of the login authentication process: passphrases and passwords , ResearchGate
28. Long Passphrases: Potentials and Limits , arXiv
29. Encouraging users to improve password security and memorability , International Journal of Information Security (Springer)

This article was drafted with the help of AI and reviewed by Jaroha editors before publication.