Why 4 words is the sweet spot for most people
Four words gives around 44 bits of entropy — enough to make an offline brute-force attack take billions of years with current hardware, while remaining memorable with a small mental trick. Five or six words is better for your most critical accounts. Three words is borderline for anything important.
Add a mental image for each passphrase
The memory palace technique works brilliantly with passphrases. For "maple-guitar-frozen-bridge", visualise a maple tree playing a guitar on a frozen bridge. The more vivid and absurd the image, the stickier the memory. You can recall the passphrase without writing it down just by replaying the image.
Use passphrases for your password manager master key
Your password manager's master password is the most important password you have — it unlocks everything else. A 6-word passphrase is perfect here: high entropy, typeable without a keyboard shortcut, and memorable enough that you will never need to write it down. Generate one with the capitalise option and a hyphen separator.
The separator matters for typing speed
Hyphens are the best separator for most people — they are on a single key, familiar, and don't require Shift. Spaces are natural to say aloud but get rejected by some password forms. If you need to type the passphrase frequently (like a laptop login), spaces or no separator might actually be faster once memorised.
Generate multiple and choose the most memorable
Use the bulk generation feature to generate 10 passphrases at once. Pick the one whose words form the most vivid mental image. The randomness is equally strong for all of them — choosing the most memorable one does not compromise security.
Use the number option for stubborn password policies
Some websites still enforce old-fashioned password rules: "must contain a number". The append number option adds a random 4-digit number to the end of your passphrase, satisfying this requirement without the security theatre of substituting letters with numbers (like replacing 'a' with '@').
Pair with the password strength checker
After generating a passphrase, you can paste it into the Password Strength Checker to see how it scores on dictionary-based pattern detection. Strong passphrases from random word lists score very highly because the words are selected randomly, not based on a human-memorable pattern.