Password vs Passphrase

Both are the same trick — a uniform random draw — wearing different clothes. A generated password draws characters from a pool of up to 94 (≈6.6 bits each); a passphrase draws words from a list of 1,316 (≈10.4 bits each). The winner depends on who has to remember and type it: software, or you.

The comparison, in numbers

	Random password	Passphrase
Entropy per unit	6.55 bits / character	10.36 bits / word
≈80 bits takes	13 characters	8 words
≈104.9 bits takes	16 characters	11 words
Typing on a phone	Slow; symbols hide behind two keyboard switches	Fast; words are what phone keyboards are built for
Memorizing	Impractical beyond one or two	One vivid scene per passphrase; a handful is realistic
Reading aloud / typing on a TV	Error-prone (0 vs O, 1 vs l)	Easy, especially with look-alike-free words

So which, where?

Accounts a manager stores (almost all of them): a 16–20 character generated password. Nobody memorizes or types it, so take the compact entropy.
The master password to that manager: a passphrase of 5–6 words (51.8–62.2 bits). You will type it daily; make it words.
Device logins, Wi-Fi, anything typed on odd keyboards: passphrase again — Smart TVs and game consoles are where character soups go to die.
Anything a site caps at a short length: a generated password at the maximum length and pool the site allows; the cap, not the format, is the limit.

The failure mode to avoid is the middle path: a human-invented "clever" phrase or a decorated word. Invention collapses the space to what humans invent, and cracking tools search that space first. Whichever format you pick, let the generator draw it — characters or words — and the entropy in the tables above is the entropy you actually get.

FAQ

Aren't words easier to guess than random characters?

One word, yes. Five words drawn uniformly from 1,316 is 1,316⁵ combinations — about 51.8 bits — and guessing must try them in combination, not word by word. Length in words does for passphrases what length in characters does for passwords.

Should my passphrase include a symbol or number "for the rules"?

If a site demands one, add it — a random digit honestly adds ≈3.3 bits. Decorations you choose yourself (always a "!" at the end) add keystrokes, not entropy, because attackers model them first.

Can I use a passphrase everywhere?

Some sites cap length below a 5-word phrase or reject spaces. Use the longest the site allows; where a passphrase fits, it is a fine choice, provided it is unique to that account and stored in your manager.