A passphrase strings together several unrelated words, like "correct-horse-battery-staple," while a fully random password mixes letters, numbers, and symbols with no linguistic pattern at all. Both can be secure — the details matter more than the category.

The case for passphrases

Passphrases are easier for humans to remember and, if long enough (typically four or more truly random words), can offer strong resistance to brute-force attacks while remaining typeable without a password manager in a pinch.

The case for random passwords

A generated random password packs more entropy per character, since it draws from a larger character set. For any account where you're storing the password in a manager anyway, there's no memorability tradeoff to worry about.

The practical recommendation

• Use a passphrase for your password manager's master password, since you need to type and remember it
• Use a fully random generated password for every other account, since your manager remembers it for you