Diceware Passphrase vs Random Password

Random passwords win inside a manager you unlock once. Passphrases win when you have to type the secret yourself under pressure.

Random

/tool/password-generator — long, mixed characters, copy once into the vault.

Diceware-style

/tool/diceware-passphrase — word sequences you can actually type. Still use unique phrases per important account.

Check, don’t reuse

Score candidates on /tool/password-strength-meter. Never reuse bank and email passwords.

Not for passwords

/tool/hmac-sha256-generator builds message authentication codes, not login secrets.

Which one you will actually be able to use

A 24-character random password is the right default when a manager types it for you. It is the wrong default for a shared kiosk, a TV, or a laptop you unlock in front of someone. A short passphrase of several common words is easier to type and still hard to guess if it is long enough and unique. Write it into the manager too — memorable is not the same as “I will remember it in eight months.” Use a different phrase per account that matters. The strength meter is a sanity check on length and repetition, not a promise that a particular site will accept the characters. Some sites reject spaces or limit length. If they do, generate a random password that fits their rules instead of weakening a passphrase until it matches. HMAC and hash tools prove a message or a checksum. They are not login generators, and their output should not be reused as a password. Count the words after you generate the phrase. Four short words are easier to type and easier to guess than six. If a site bans spaces, decide whether to keep the words without spaces or switch to the random generator. Check the saved length in the manager before you rely on it, because some forms cut off the end.