For most accounts, use a different randomly generated password for every site and store it in a password manager. Use a passphrase for the small number of secrets you must remember—especially the password that unlocks your manager. A passphrase is still a password: its safety depends on randomness, length, uniqueness, and how it is stored, not on the fact that it contains words.
The short answer
Choose a randomly generated password when a password manager can create, save, and autofill it. Random generation removes the guessable patterns people commonly introduce, and a manager makes it practical to keep every account’s password unique.
As an Amazon Associate I earn from qualifying purchases.
Choose a long passphrase when you genuinely need to memorize the secret. That usually means a password-manager master password, a recovery secret kept offline, or a device login that cannot use a manager. A passphrase made from words you personally thought of is not automatically random; names, quotations, song lyrics, keyboard patterns, and familiar sayings are common guesses.
Recommended Free Tools
Neither option protects you from phishing. The National Institute of Standards and Technology (NIST) states in SP 800-63B-4, published in July 2025: “Passwords are not phishing-resistant.” Password selection helps with guessing, reuse, and storage. It does not make a fake login page safe to use.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Passphrase and random password are not separate authentication factors
NIST treats “password” as the broad category: a secret that may be memorized or recorded. A passphrase is one form of password, usually written as several words and spaces. A random password may contain letters, numbers, symbols, or randomly selected words. Both are knowledge-based secrets entered into a verifier.
The meaningful comparison is therefore how the secret was created and how it is handled:
- Memorable passphrase: several words selected so a person can recall them. It can be strong when the words are selected randomly and the result is long and unique.
- Randomly generated password: a secret produced by a trusted random generator, normally one password per account and stored in a manager.
An unusual phrase that feels original to you may still be predictable to an attacker. A generator does not need to produce an aesthetically complicated string; it needs to choose characters or words unpredictably and independently.
What actually determines password strength
Randomness beats personal cleverness
Attackers begin with lists of common passwords, breached passwords, names, dates, quotations, and predictable substitutions such as replacing “a” with “@”. A phrase assembled from your interests or life events can be tested quickly. Random selection prevents an attacker from narrowing the search using information about you.
For a memorized passphrase, use a method that does not depend on your biography or favorite media. The Electronic Frontier Foundation (EFF) describes a dice-generated method: roll physical dice, use the resulting number sequence to select words from the method’s word list, and repeat until the phrase is long enough. The dice provide the randomness; the word list turns random numbers into words that are easier to remember.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Length increases the search space, but no threshold is magic
Longer secrets generally give an attacker more possibilities to try. Length also makes a passphrase easier to remember without relying on a predictable sentence. However, a 30-character quotation that appears in password dictionaries is not equivalent to 30 random characters or randomly selected words.
NIST’s current figures describe what a website verifier must accept, not a guarantee that every password meeting the figure is strong:
Free tools Windows power users keep installed
One-click scans. No signup required.
| NIST SP 800-63B-4 guidance | What it means |
|---|---|
| 15 characters | A verifier must require at least 15 characters when a password is used as a single-factor authentication mechanism. |
| 8 characters | A verifier may permit a shorter minimum when the password is used as part of multi-factor authentication, but not below eight characters. |
| At least 64 characters | A verifier should permit a maximum password length of at least 64 characters. |
| Spaces | Verifiers should accept spaces, which allows natural-looking passphrases. |
| Composition rules | Verifiers should not impose extra rules requiring mixtures such as an uppercase letter, a number, and a symbol. |
These are requirements and recommendations for services that check passwords. They do not certify a password as safe merely because it has 15 or 64 characters. A unique random password remains the better default for accounts you do not need to memorize.
Uniqueness limits the damage from a breach
Reusing one memorable phrase across sites creates an account-linkage problem. If one service is breached or a password is phished, attackers can try the same secret everywhere else. NIST’s usability guidance discusses distinct passwords specifically to reduce password-stuffing risk. A manager allows each account to have a different generated password without requiring you to remember each one.
Passphrase or generated password: the practical trade-offs
| Decision point | Memorable passphrase | Randomly generated password |
|---|---|---|
| Randomness | Strongest when produced by a genuinely random word-selection method. A self-created phrase can be guessable. | A manager’s generator can create a distinct secret for each account. |
| Memorability | Useful when one secret must be recalled without a manager. | Usually stored in a manager rather than memorized account by account. |
| Length and entry | Several words and spaces can make a long secret easier to type and recall; the verifier must support them. | Can be long and complex; compatibility with the site’s fields, autofill, and paste behavior matters. |
| Reuse risk | Reusing one phrase across sites links those accounts. | A manager helps maintain a different generated password for every account. |
| Phishing exposure | Still a password and therefore not phishing-resistant. | Also a password and therefore not phishing-resistant. |
Which choice fits each situation?
Everyday websites and apps
Use a manager-generated password unique to that account. Let the manager generate a length the site accepts, save it immediately, and use autofill. If autofill is unavailable, paste from the manager rather than shortening the password or reusing another one. NIST’s current guidance requires verifiers to allow password managers and autofill, and recommends paste support when an autofill API is not available.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
The password that unlocks your manager
This is the main case for a passphrase. You need to recall it when the manager is locked, when setting up a new device, or when autofill is not yet available. Generate the words with a random method such as the EFF dice approach, make the phrase unique to the manager, and avoid storing a plain-text copy in the same vault it protects.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteProtect this secret more carefully than any individual account password. NIST’s FAQ notes that compromise of a manager’s master secret can require replacing the passwords in the vault; that FAQ discusses the earlier SP 800-63-3 edition, so treat it as contextual background rather than the current normative standard.
A device or account where no manager is available
Use a long, randomly selected passphrase if the system accepts spaces. If it rejects spaces, use randomly selected words joined with a separator that the system accepts. Do not turn a memorable phrase into a predictable pattern merely to satisfy an outdated composition rule.
High-value accounts
Use a unique generated password stored in the manager, enable the strongest available multi-factor option, and review recovery methods. A password’s length does not replace a second factor, and neither a passphrase nor a generated string prevents a phishing site from capturing what you type.
How to set up a safer password system
- List your accounts. Start with email, financial services, cloud storage, social networks, work systems, and any account that can reset another account. Mark reused or recently exposed passwords for immediate replacement.
- Choose a password manager. Select one that generates passwords, supports autofill on your devices, allows export or recovery in a form you understand, and protects the vault with a secret you can remember. The manager is a storage and generation tool; it does not make a password phishing-resistant.
- Create the manager’s master passphrase. Use a random word-selection process. Make it long enough to remember without personal references, and do not reuse it anywhere else.
- Replace reused passwords first. Open each service’s account-security page, change the password, and have the manager generate a separate value. Save it in the matching vault entry before signing out.
- Turn on multi-factor authentication. Prefer an authenticator app, hardware security key, or another option the service supports. Keep recovery codes in a protected offline location rather than in a public note.
- Test autofill and sign-in. Sign out, close the browser or app, and confirm that the manager can fill the username and password on the correct site. This catches wrong-domain entries and missing saves.
- Plan recovery. Know how to regain access to the manager, your primary email, and your second-factor device. A recovery plan should not expose the master passphrase beside the vault.
How to make a random passphrase you can remember
Use a physical dice method
EFF’s dice-generated passphrase instructions use repeated rolls and a corresponding word list. The important properties are the physical randomness and the list, not the brand or type of dice. Five standard six-sided dice can be rolled one at a time or together if you record each result accurately; follow the word-list method’s exact number sequence and keep rolling until you have enough words.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
- Obtain the word list used by the method and keep it available while generating the phrase.
- Roll the dice for the number of digits the list requires.
- Look up the resulting sequence and write down the selected word.
- Repeat until the phrase has several independent words and is long enough for the verifier.
- Join the words with spaces if the service accepts them. Otherwise use a permitted separator without adding a predictable personal pattern.
- Store the result in a secure location and never reuse it for another account.
Do not “improve” the result by swapping words for names, adding a birth year, or choosing words that tell a story about you. Those changes reduce the randomness the method provided.
When a manager’s word generator is available
A reputable manager can generate a word-based password directly. Set the length or word count the service permits, confirm that the output is different from previous passwords, and save it immediately. If you cannot verify how a tool generates randomness, use the manager’s built-in generator rather than an unknown website.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common failure modes and fixes
“The site says my long passphrase is too long.”
NIST recommends that verifiers permit at least 64 characters, but individual services can still have implementation defects or older limits. Check whether the site rejects spaces, silently truncates input, or imposes a documented maximum. Use a shorter randomly generated value only within that site, and report truncation or unexplained rejection to the provider. Never shorten the same password for several services.
“The site demands an uppercase letter, number, and symbol.”
NIST’s 2025 guidance says verifiers should not impose such composition rules. You cannot change a site’s implementation from the sign-up form, so use a manager-generated value that satisfies the requirement for that account, then keep it unique. Do not apply the same forced pattern to every account.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →“Autofill does not work.”
Confirm that the manager entry is saved under the exact domain, that the browser or operating system has granted autofill permission, and that the login form is not inside an unsupported frame. If the service does not expose a compatible autofill interface, paste the saved password. NIST explicitly discusses manager and autofill support and recommends paste support where an API is unavailable.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
“I forgot the manager’s master passphrase.”
Use the manager’s documented recovery process, emergency kit, or device session if one exists. Do not guess repeatedly if the manager uses a lockout or delay. If recovery is impossible, you may need to reset accounts one by one; this is why the master passphrase should be memorable, unique, and backed by a recovery plan kept separately from the vault.
“I entered the password into a suspicious page.”
Assume the password is compromised. From a trusted device, change it on the real site, replace it anywhere it was reused, revoke active sessions, and review multi-factor and recovery settings. A longer passphrase does not undo a phishing disclosure.
What passwords cannot solve
Password advice addresses only the secret itself. Malware, fake login pages, session theft, compromised email, and weak account-recovery procedures remain separate risks. NIST’s statement that passwords are not phishing-resistant applies equally to a 20-character random string and a long passphrase.
Use the site’s verified domain, avoid signing in through unsolicited links, and consider phishing-resistant authentication such as a hardware security key when the service offers it. Keep multi-factor recovery codes private and monitor sign-in alerts. These controls complement unique passwords; they do not make reusing a password acceptable.
A simple decision rule
- Can a trusted manager generate and autofill the secret? Use a unique random password.
- Must you remember and enter it yourself? Use a long passphrase generated with a random method.
- Will the secret be used on more than one service? Stop and create separate secrets.
- Does the service support spaces, long inputs, managers, and paste? Use those features; if it does not, adapt only that account’s password rather than weakening the rest of your system.
- Are you worried about a fake login page? Change your sign-in process or add phishing-resistant MFA; changing from words to symbols alone will not solve phishing.
Bottom line
For ordinary online accounts, a password manager’s unique randomly generated passwords are the most practical choice because they combine unpredictability with account-by-account separation. Reserve a carefully generated passphrase for the manager’s master secret and other credentials you truly must memorize. Follow NIST’s current length and usability guidance, but treat 15, 64, or any other number as a verifier requirement—not a promise of security—and remember that no password is phishing-resistant.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
