Nym Key — Keys and passphrases for a pseudonymous online | nymkey.com
Entropy is the only honest way to compare a word passphrase with a character password — this page converts both into bits before you choose either.
Bits of entropy are the base-2 logarithm of how many equally likely secrets exist. Draw one character from the 94 printable ASCII symbols and you get 6.55 bits; draw one word from a 7,776-word list and you get about 12.9 bits. The unit is the same, so the two constructions can finally be compared line by line.
For word passphrases the arithmetic is clean: four words give about 52 bits, five words about 65, six about 78. Each added word multiplies the attacker's work by 7,776, which is why one extra word beats any amount of creative capitalization.
For character passwords the same honesty applies: twelve random characters sit near 79 bits and sixteen near 105 — but only when every character is machine-random. A string you typed from imagination is drawn from a far smaller pool, and its true entropy is unknowable, which is the practical argument for letting a generator choose.
On narrow screens, swipe or scroll the plate sideways.
NIST SP 800-63B frames the floor and the ceiling: services must accept at least 8 characters, must allow at least 64, and must screen candidates against breach lists. The 64-character allowance is what makes five- and six-word passphrases usable in practice, and the screening requirement exists because the most popular human choices are already public.
A workable rule: pick a target first — about 65 bits for everyday accounts, 78 bits or more for the master secret that guards the rest — then generate randomly to that target and verify the length against the table.
Once the passphrase is sized, the next decisions are the second factor that protects sign-in and the recovery seed that protects everything; both are covered in the companion pages linked below.
Further reading