Skip to main content

Ditch the Password, Own the Passphrase

Overview

Passwords are dying — not because they stopped working, but because computers got terrifyingly good at guessing them. This page explains why PBR is moving to passphrases, what the Australian Cyber Security Centre (ACSC) actually recommends, and how to build one in under a minute.

TL;DR: Stop using Winter2026!. Start using four random words strung together, like correct horse battery staple. Longer beats clever, every time.

The Maths Is Not on Your Side

Modern cracking rigs can attempt billions of password guesses per second. Short "complex" passwords — the classic capital-letter-number-symbol combo — fall fast because they're short, even with the symbols thrown in. Length, not complexity, is what actually slows an attacker down.

CredentialLengthApprox. time to crack*
Winter26!9 charactersMinutes to hours
Tr0ub4dor&311 charactersA few days
correct horse battery staple28 charactersCenturies+

*Illustrative only — actual crack times depend on hashing method and attacker resources, but the pattern holds: length wins.

Password vs Passphrase — What's the Difference?

PasswordPassphrase
StructureShort string, mixed charactersSeveral random words, spaces allowed
ExampleP@ssw0rd1purple duck potato boat
Easy to remember?Not reallyYes
Easy to crack?YesNo, if genuinely random

What the ACSC Actually Says

This isn't a PBR opinion — it's straight from Australia's national cyber security authority (ACSC, part of the Australian Signals Directorate) and the Information Security Manual (ISM):

  • Go long: aim for a passphrase of 4 or more random, unrelated words totalling at least 14–15 characters.
  • Random beats meaningful: the words should have no logical connection to each other and no connection to you (no pet names, birthdays, football teams).
  • Skip the sentences: a grammatically correct sentence, a movie quote, or a song lyric is easier to guess than it feels — attackers use these exact sources as cracking dictionaries.
  • Don't force frequent changes: the ACSC now recommends against mandatory periodic password resets (e.g. every 30 or 90 days) purely for the sake of it, because it pushes people toward small, predictable tweaks (Summer2025! → Summer2026!). Change your credential when you suspect it's been compromised, not on a fixed calendar.
  • Use MFA wherever it's offered — a great passphrase is still stronger with a second factor behind it.

Further reading: cyber.gov.au – Set secure passphrases

Building a Good One in 60 Seconds

  1. Pick four (or more) words that have nothing to do with each other. Think of the most random things you can — an animal, an object, a colour, a place.
  2. Don't pull them from a well-known quote, lyric, or saying.
  3. String them together with spaces, hyphens, or just jam them together: tractor lemon violin harbour.
  4. Optional: swap a letter for a number or add a symbol somewhere if the system requires it — but don't rely on this for strength, the word count is doing the heavy lifting.
  5. Never reuse it anywhere else, and store it in 1Password rather than memory or a sticky note.

✅ Good Examples

  • giraffe pixel thunder mango
  • orbit-cactus-ferry-42
  • quiet volcano bicycle jelly

❌ Weak Examples (Avoid These)

  • Password123! — short, predictable pattern
  • IloveMyDogRex2026 — personal info, guessable structure
  • tobeornottobe — a real, well-known quote
  • correct horse battery staple — great as a teaching example, but now so famous it's in every cracking dictionary on earth. Use the idea, not this exact phrase!

Quick Reference Card

RuleGuidance
Minimum length14–15+ characters
Word count4 or more random words
ReuseNever — unique per account
Storage1Password only — not memory, not sticky notes, not a text file
When to change itOn suspected compromise — not just because a calendar says so
MFAAlways enable where available

Sources

Last updated: 28 July 2026. Questions? Contact [email protected].

Back to top