Passphrase vs Password: What should you use?
Are Passwords the way forward?
Balancing security and usability is a must, but passwords today don’t cut it. IT administrators need to change for the better and need to upgrade from passwords to passphrases.
Passwords and passphrases serve the same purpose. But passwords are generally short, hard to remember and easier to crack. Passphrases are easier to remember and to type, and they’re considered more secure due to their length and because you don’t need to write them down. A passphrase can also contain symbols, and does not have to be a proper sentence or grammatically correct. The main difference between the two is that passwords do not have spaces while passphrases have spaces and are longer than any random string of letters.
Why are passphrases better than passwords?
- Passphrases are easier to remember than a random of symbols and letters combined together. It would be easier to remember a phrase from your favorite song or your favorite quotation than to remember a short but complicated password.
- Passwords are relatively easy to guess or crack by both human and robots. The online criminals have also leveled up and developed state of the art hacking tools that are designed to crack even the most complicated password.
- Satisfies complex rules easily. The use of punctuation, upper and lower cases in Passphrases also meets the complexity requirements for passwords.
- Major OS and applications supports passphrase. All major OS including Windows, Linux and Mac allow pass-phrases of up to 127 characters long. Hence, you can opt for longer passphrases for maximum security.
- Passphrases are next to impossible to crack because most of the highly-efficient password cracking tools breaks down at around 10 characters. Hence, even the most advanced cracking tool won’t be able to guess, brute-force or pre-compute these passphrases.
How to Create a Strong Passphrase
If you’re going to use a passphrase, you need to make it strong enough so that hackers can’t easily crack it during a brute force attack. At minimum, include at least four words in your passphrase. The words you use, the better protected your passphrase will be against brute force attacks.
Regardless of how many words you use in a passphrase, make sure it’s at least 15 characters long (including spaces). Using fewer than 14 or fewer characters increases the risk of a hacker cracking your passphrase using automated software.
Related Articles
Password Policy
Password Policy ensures that a user password is strong and is changed in a periodic manner so that it becomes highly impossible for an attacker to crack the password. To edit Password Policy settings: Go to Start Menu → Administrative Tools → Group ...
Fine-Grained Password Policies
In Active Directory, there can be only one Password Policy and Account-Lockout Policy per domain. Situations may arise in which setting different account policies for different types of users will be required. For example, employees in the finance ...
Drawbacks of Active Directory Password Policy
Microsoft Password Policy: 3 Crippling Drawbacks Password Policy ensures that a user password is strong and is changed in a periodic manner so that it becomes highly impossible for an attacker to crack the password. If you are in the process of ...
Domain Password Policies: Configuring and Auditing Correctly!
Over the past 14 years, I have been around the world helping admins, auditors, and security professionals understand how the domain password policy works in Active Directory. The default behavior has not changed in those 14 years, so you can imagine ...
Active Directory Password Policy Best Practices
Active Directory Password Policies: NIST Recommended Best Practices End-user passwords are one of the weakest components of your overall security protocols. Most users tend to reuse passwords across work and personal accounts. In Microsoft Active ...