§ Passphrase
For passwords you actually have to type.
Four common words joined together, lightly capitalised, with an optional couple of digits on the end. Looks like Otter-Lantern-Beach-Twig47. The UK's National Cyber Security Centre recommends this style for accounts you log into regularly: email, work sign-ins, your password manager itself.
- ▸Memorable. You can type it without copying and pasting.
- ▸Strong by length. Even a fast attacker would need thousands of years.
- ▸Word list is curated and friendly. No swearing, no jargon, no homophones.
§ Random characters
For passwords your password manager remembers.
Sixteen to twenty characters from across the keyboard. Looks like 7v$Lk2.eP9!nQrJm. More entropy per character than any passphrase. Not for typing by hand. Pair this with a password manager (1Password, Bitwarden, your browser's built-in one) and let it handle the input.
- ▸Strongest option per character. Sixteen characters equals roughly 100 bits of entropy.
- ▸Adjustable: pick which character classes are in, exclude look-alike pairs like 0/O if you like.
- ▸Guaranteed at least one of each enabled class, so it always passes site rules.