# Ditch the Password, Own the Passphrase

## Overview

Passwords are dying — not because they stopped working, but because computers got terrifyingly good at guessing them. This page explains why PBR is moving to **passphrases**, what the Australian Cyber Security Centre (ACSC) actually recommends, and how to build one in under a minute.

<p class="callout danger">Stop using `Winter2026!`. Start using four random words strung together, like `correct horse battery staple`. Longer beats clever, every time.</p>

---

## The Maths Is Not on Your Side

Modern cracking rigs can attempt billions of password guesses per second. Short "complex" passwords — the classic capital-letter-number-symbol combo — fall fast because they're short, even with the symbols thrown in. Length, not complexity, is what actually slows an attacker down.

<table id="bkmrk-credentiallengthappr"><thead><tr><th>Credential</th><th>Length</th><th>Approx. time to crack\*</th></tr></thead><tbody><tr><td>`Winter26!`</td><td>9 characters</td><td>Minutes to hours</td></tr><tr><td>`Tr0ub4dor&3`</td><td>11 characters</td><td>A few days</td></tr><tr><td>`correct horse battery staple`</td><td>28 characters</td><td>Centuries+</td></tr></tbody></table>

*\*Illustrative only — actual crack times depend on hashing method and attacker resources, but the pattern holds: length wins.*

---

## Password vs Passphrase — What's the Difference?

<table id="bkmrk-passwordpassphrase-s"><thead><tr><th> </th><th>Password</th><th>Passphrase</th></tr></thead><tbody><tr><td>Structure</td><td>Short string, mixed characters</td><td>Several random words, spaces allowed</td></tr><tr><td>Example</td><td>`P@ssw0rd1`</td><td>`purple duck potato boat`</td></tr><tr><td>Easy to remember?</td><td>Not really</td><td>Yes</td></tr><tr><td>Easy to crack?</td><td>Yes</td><td>No, if genuinely random</td></tr></tbody></table>

---

## What the ACSC Actually Says

This isn't a PBR opinion — it's straight from Australia's national cyber security authority (ACSC, part of the Australian Signals Directorate) and the Information Security Manual (ISM):

- **Go long:** aim for a passphrase of **4 or more random, unrelated words** totalling **at least 14–15 characters**.
- **Random beats meaningful:** the words should have no logical connection to each other and no connection to you (no pet names, birthdays, football teams).
- **Skip the sentences:** a grammatically correct sentence, a movie quote, or a song lyric is easier to guess than it feels — attackers use these exact sources as cracking dictionaries.
- **Don't force frequent changes:** the ACSC now recommends **against** mandatory periodic password resets (e.g. every 30 or 90 days) purely for the sake of it, because it pushes people toward small, predictable tweaks (`Summer2025!` → `Summer2026!`). Change your credential when you suspect it's been compromised, not on a fixed calendar.
- **Use MFA wherever it's offered** — a great passphrase is still stronger with a second factor behind it.

Further reading: [cyber.gov.au – Set secure passphrases](https://www.cyber.gov.au/learn-basics/explore-basics/passphrases)

---

## Building a Good One in 60 Seconds

1. Pick **four (or more) words** that have nothing to do with each other. Think of the most random things you can — an animal, an object, a colour, a place.
2. **Don't** pull them from a well-known quote, lyric, or saying.
3. String them together with spaces, hyphens, or just jam them together: `tractor lemon violin harbour`.
4. Optional: swap a letter for a number or add a symbol somewhere if the system requires it — but don't rely on this for strength, the word count is doing the heavy lifting.
5. Never reuse it anywhere else, and store it in **1Password** rather than memory or a sticky note.

### ✅ Good Examples

- `giraffe pixel thunder mango`
- `orbit-cactus-ferry-42`
- `quiet volcano bicycle jelly`

### ❌ Weak Examples (Avoid These)

- `Password123!` — short, predictable pattern
- `IloveMyDogRex2026` — personal info, guessable structure
- `tobeornottobe` — a real, well-known quote
- `correct horse battery staple` — great as a teaching example, but now so famous it's in every cracking dictionary on earth. Use the idea, not this exact phrase!

---

## Quick Reference Card

<table id="bkmrk-ruleguidance-minimum"><thead><tr><th>Rule</th><th>Guidance</th></tr></thead><tbody><tr><td>Minimum length</td><td>14–15+ characters</td></tr><tr><td>Word count</td><td>4 or more random words</td></tr><tr><td>Reuse</td><td>Never — unique per account</td></tr><tr><td>Storage</td><td>1Password only — not memory, not sticky notes, not a text file</td></tr><tr><td>When to change it</td><td>On suspected compromise — not just because a calendar says so</td></tr><tr><td>MFA</td><td>Always enable where available</td></tr></tbody></table>

---

## Related Pages

- [Keeping Your Account Secure](https://bookstack.pbr.org.au/books/security-awareness/page/keeping-your-account-secure)
- [How To Use 1Password](https://bookstack.pbr.org.au/books/passwords/page/how-to-use-1password)

---

## Sources

- Australian Cyber Security Centre – [Set secure passphrases](https://www.cyber.gov.au/learn-basics/explore-basics/passphrases)
- Australian Cyber Security Centre – [Why it's time to ditch your one password for passphrases](https://www.cyber.gov.au/about-us/news/ditch-password-for-passphrases)
- Australian Government Information Security Manual (ISM) – Guidelines for System Hardening, passphrase control