Password vs. Passphrase: Which Is More Secure?

User credentials, like a username and password, are the first layer of defense against cyberattacks for most organizations. Understanding passwords and passphrases, and the security implications of both, will help your organization establish strong policies and stay as secure as possible.

“Instead of using a short, complex password that is hard to remember, consider using a longer passphrase.”

Federal Bureau of Investigations

Learn what modern cyberattacks look like and additional ways businesses can best prepare to defend themselves in DOT Security’s eBook, The State of Cybersecurity for Small Businesses. 

 

What Is a Password?

A password is a string of characters used to verify the identity of a user who is trying to access a computer system, device, or account. Passwords are typically created by the user or auto-generated by an app and are kept confidential in order to prevent unauthorized access to sensitive information or resources.

In order to ensure security, passwords should be complex (including at least one special character and number), long (use at least 16 characters), unique, and changed regularly to prevent them from being guessed or hacked.

What Is a Passphrase?

A passphrase is a sequence of words, rather than just a single word, used as a security measure for authentication or encryption purposes.

Functionally, passphrases are identical to passwords in that they are kept secret and used to authenticate user access. However, passphrases tend to be longer, more complex, and yet, easier to remember than traditional passwords, all-in-all making them more difficult for hackers to crack.

Unlike passwords, which are typically shorter and more straightforward, passphrases are often more user-friendly, making them a popular choice for secure authentication and encryption methods.

For example, of a strong passphrase made up of four random words can look like “SillyK!ttiesL0veTre@ts!” This passphrase works because:

• It has a reference only the individual user will remember
• It is difficult to guess and will not appear in a common password database
• It uses special characters, capital and lowercase letters, and numbers
• It is longer than 16 characters

It might seem like a bad idea to use a string of words for your credentials, but passphrases are actually much easier to remember when compared to complex passwords that have no strong mental association and still offer much better security.

Why Are Passphrases Important?

Simple passwords are not as secure today as they once were, and yet many people still rely on them every day, increasing the amount of cybersecurity risk an organization carries.

“The more a password is reused, the more opportunities there are for your data and money to be stolen. If a reused password gets leaked as part of a data breach, hackers then have the key to your other online accounts.”

In fact, 13% of Americans use the same password for every account they own.

Simply adopting newer techniques like passphrases instead of one-word passwords is an easy way to improve your cybersecurity posture and defend against potential attacks.

Human Error and Cybersecurity

You can use every solution in the world, and it still won’t matter if someone clicks enough times on a malicious link from a phishing campaign.

The unfortunate reality is that human error plays a critical role in successful cyberattacks. When cybercriminals perform attacks, they send out thousands (or even millions) of spam messages to dupe victims into following a malicious link. All it takes is one person to fall for their scam, which happens on an all-too-regular basis.

In fact, just earlier this year, Caesars Entertainment fell victim to a massive data breach that all started with a social engineering attack against the internal IT department in which a malicious actor posed as an employee in order to manipulate the IT department into handing over credentials.

Once a malicious link or file has been engaged, the hacker has a number of ways to breach the end user’s device—including tactics like installing a keylogger, directing them to a fraudulent website, or infecting the device with malware. They can then access sensitive personal or business data by logging in at will and stealing information.

This is a common way that organizations are breached and continues to be a major problem today. 52% of companies acknowledge staff as the biggest security vulnerability they need to address.

However, it’s not quite so simple as the employee being at fault. For example, even if a password is stolen, an organization that has implemented multifactor authentication (MFA) will see the hack prevented.

The above hypothetical demonstrates the value of a layered cybersecurity defense. Implementing MFA protocols and emphasizing employee training and awareness around cybersecurity can drastically strengthen your overall security standing.

Recapping Passphrase Strengths

As stated in the opening, passphrases are undoubtedly more secure than one-word passwords. They’re also much easier to remember.

This is because passphrases can be more complex and longer than passwords while still providing a strong mental association to the user. Together, this makes a passphrase much more difficult to breach.

A substantial number of data breaches occur primarily due to the lack of strong passwords—often because the company doesn’t enforce a firm password policy. By instilling one that promotes the use of passphrases vs. passwords, your company will be well on its way to a more secure future.

Brute Force Attacks

When cybercriminals are looking to hack someone’s account, they don’t sit there typing in different combinations of a password for weeks on end until they guess right. Rather, they design a computer algorithm (or buy one from the dark web) to do it for them.

The algorithm will test tens of millions of combinations again and again until eventually the password is cracked.

The shorter the password, the quicker this process happens. This type of cyberattack is known as a brute-force attack and is very common today.

Over 80% of breaches caused by hacking involve brute force or the use of lost or stolen credentials.

Length is the best defense against brute force cyberattacks, making a complicated and lengthy passphrase the ideal option over a shorter password with even the most complex string of characters.

FBI Recommendation

Finally, we have the FBI’s recommendation on the use of passphrases for businesses.

The FBI launched a project called Protected Voices, with the intention of providing cybersecurity recommendations to political campaigns and businesses operating in the US.

The project called for passphrases and multifactor authentication to be used to best ensure that sensitive data was protected effectively. Passphrases were strongly advised to improve security and better protect sensitive data.

As we can see from the FBI's recommendations, passphrases are the standard best practice regarding cybersecurity and should be used by every modern organization looking to improve their security posture.

Wrapping up on Passphrases vs. Passwords

Many passwords and habits employed by end users are not fit for the sophistication and regularity of cyberattacks today. However, using more secure passphrases over passwords is strongly advised to tamper total cybersecurity risk.

Businesses should also strongly consider implementing MFA protocols and regular employee awareness training alongside passphrase policies to bolster their cybersecurity posture, prepare for potential cyberattacks, and minimize the amount of cyber risk they carry.

To discover other factors affecting the cybersecurity of businesses, download DOT Security's report, The State of Cybersecurity for Small Businesses.