Is a 4-Word Passphrase Strong Enough?

Published June 16, 2026

Short answer: for most everyday accounts protected by rate-limiting and two-factor authentication, a randomly generated 4-word passphrase (~52 bits of entropy, about 3.7 quadrillion combinations) is strong enough. But it sits on the lower edge of modern recommendations. For high-value accounts — your email, password-manager master password, banking, crypto — step up to 5 or 6 words. And the rule that matters more than length: the words must be picked randomly by a generator. A 4-word phrase you made up yourself is weak no matter how clever it feels.

What "4-word passphrase" means

A passphrase is a sequence of random words used instead of a character password — for example maple-orbit-thunder-cabin. The strength comes entirely from how the words are chosen. The standard approach (Diceware) draws each word at random from a list of 7,776 words, so a 4-word passphrase is one of 7,776⁴ ≈ 3.7 quadrillion equally likely combinations. That randomness is what an attacker has to defeat — not the words themselves.

How strong is it, really?

Security is measured in bits of entropy — each bit doubles the work for an attacker. Here's how passphrase length stacks up, using the 7,776-word list:

*Assumes a powerful offline attack of ~100 billion guesses per second against a fast or leaked password hash — the realistic worst case. Against a modern slow hash (bcrypt, Argon2) or any online login with rate-limiting, even 4 words would take far longer. Want the full picture? See how long it would take to crack your password.

So is 4 words enough — or not?

It depends on what you're protecting and how it can be attacked:

• 4 words is fine for ordinary accounts (forums, shopping, apps) — especially when the login is rate-limited and you have two-factor authentication on. An attacker can't run billions of guesses against a live login form.
• 4 words is risky when the secret could be attacked offline — a leaked database with weak hashing, an encrypted file or vault, a crypto wallet. There the attacker guesses as fast as their hardware allows, and ~52 bits can fall in hours.

Because you usually can't know how a service stores your secret, the safe habit is simple: treat 4 words as the floor, use 5 words as your default, and 6 words for anything important.

The mistake that breaks any passphrase

Length is the second most important thing. The first is true randomness. If a human picks the words — a song lyric, a sports team plus a year, a familiar saying — the passphrase has far less real entropy than the word count suggests, because attackers crack predictable patterns first. "four random words" is only strong when the words really are random. Always let a passphrase generator choose them for you.

How to make a 4-word passphrase stronger

• Add a word. Going from 4 to 5 words multiplies the difficulty by 7,776 — the single biggest, easiest upgrade.
• Keep it truly random. Generate it; don't hand-pick the words. See why in our password vs passphrase guide.
• Turn on two-factor authentication. Even a modest passphrase becomes very hard to beat when a second factor is required.
• Never reuse it. A unique passphrase per important account means one leak can't unlock the rest. Store the rest as long random passwords in a manager.

The bottom line

A randomly generated 4-word passphrase is "strong enough" for everyday use behind 2FA, but it's the minimum — not the target. Make 5 words your habit, use 6 for the secrets that guard everything else, and let a generator do the randomizing. The effort difference between 4 and 5 words is one extra word; the security difference is nearly four orders of magnitude.

← Back to Blog