What are passphrases and why are they better than passwords?

We use them every day: passwords. A string of letters, numbers, and symbols that we need to remember for our email, bank, social media – basically almost everything online. But let's be honest, most passwords aren't very strong. And why would they be? We have so many to remember! That leads to simple, easy-to-guess passwords, or reusing the same password in a dozen places. And that is just asking for trouble.

It's time to say goodbye to the password as you know it. It's time for the passphrase.

What exactly is a passphrase?

Simply put: a passphrase is a sequence of words that together form a 'password phrase'. Think of something like: "doctor-bouquet-samba-hotel-atlas-tiger". It isn't a random mess of characters, but a series of words that are easy to write down.

Why a passphrase is much more secure than a password (and what entropy has to do with it)

The strength of a password lies in its 'unpredictability' or 'randomness'. In technical terms, we call this entropy. The more entropy your password has, the harder it is for a computer to guess it, and therefore the more secure it is. Entropy expresses the number of possible combinations in 'bits'. A higher number of bits means an exponentially greater amount of work for a computer to try every possibility.

Let's look at why a passphrase has so much more entropy, and is therefore more secure:

1. Much, much longer: A password of 8-12 characters can be cracked in no time today. Often these passwords have only 20-30 bits of entropy. For a modern computer, cracking them takes just seconds to minutes. A passphrase of 4-6 words is easily 20-30 characters long, and that makes a world of difference. Every time you add an extra word, the number of possible combinations grows exponentially larger.
2. Easier to store: This is perhaps the most important reason to use a passphrase for your digital legacy: a passphrase is easy to write down and pass along without confusion. You don't have to worry about the question "Is this a capital I, a lowercase l, or the number 1?" – something that happens all too often with complex passwords. This makes transferring your Veault at the right moment much smoother.
3. Hard for computers to guess: Computers are good at guessing short, complex passwords by testing all combinations. But a sequence of random, individual words is much harder for a computer. Even with the most powerful systems, it takes millions of years to try all possible combinations of a good passphrase.

How Veault helps you with a super-strong passphrase (Diceware method)

Veault doesn't just give you any passphrase. We use the proven Diceware method. Here's how it works:

• The method uses a word list specifically chosen for word length, uniqueness, and lack of obvious associations.
• For each word chosen, a random number from 1 to 6 is generated (think of rolling a die). With six dice rolls you can choose exactly one word from the list (because 6 to the power of 5, or 7,776 options, corresponds to the length of the word list).
• Veault generates a 6-word passphrase for you based on this principle. This ensures a combination of words random enough to be extremely secure. Such a passphrase has around 77.5 bits of entropy.
• What does 77.5 bits mean in practice? With current computer technology and specialized hardware capable of making billions of attempts per second, cracking such a passphrase would take on average tens of millions to hundreds of millions of years. This is a timeframe considered virtually uncrackable in practice. Even with expected future advances in computing power, the time required to crack a password with this level of entropy remains extremely long.

Truly locking your digital vault

With a strong passphrase, you protect your Veault and all the important information stored inside it. It's a simple yet incredibly effective upgrade to your digital security. No more hassle with unreadable passwords that aren't actually secure enough. Just a phrase that's easy to store and perfectly protects your digital legacy.