Architecture
6 min read
Passphrases are 2× more memorable and exponentially harder to crack. The research is conclusive.
Security advice has long been a mess. 'Use a password with uppercase, lowercase, numbers, and symbols.' The result? P@ssw0rd1. Completely predictable, utterly useless. The password requirements that were supposed to make us more secure made us less secure by creating predictable patterns.
Entropy measures unpredictability. For passwords, it's calculated as log₂(C^L) where C is the character set size and L is the length. A random 8-character password using 95 printable ASCII characters has about 52.6 bits of entropy. That sounds solid — until you factor in that humans don't pick randomly.
A 2015 study by researchers at Carnegie Mellon found that passphrases generated via Diceware were significantly easier to remember after a two-week delay compared to system-generated random passwords of similar entropy. Human memory is optimized for words and stories, not random character strings.
The Diceware Method
Roll five dice. Look up the resulting number in a word list. Repeat 5–6 times. The result — something like 'staple-lamp-river-tower-grape' — is effectively impossible to brute-force and significantly easier to remember than 'X7#mK!2q'.
Analysis of the RockYou2024 dataset (10 billion leaked passwords) reveals that the vast majority of 'complex' passwords follow predictable patterns: a dictionary word with a number appended, a year, or a symbol substitution. These are trivially cracked by modern rules-based attacks.
For a memorable master password or recovery passphrase, a 5–6 word Diceware passphrase is both more secure and more memorable than any complex password a human is likely to create. For everything else, use a password manager to generate and store fully random credentials — which NeuroKey does by default.
Bottom Line
Passphrases are not a compromise between security and usability. They are, for human-memorized secrets, the optimal solution on both dimensions. The password complexity rules of the 2000s were based on assumptions that turned out to be wrong.
Ayoub Edahlouli
Security Engineer · NeuroKey