PASSWORD CREATION STRATEGIES: THE EFFECTIVENESS OF PASSPHRASES VS. COMPLEX PASSWORDS (EXPERIMENT)

Abstract

This study compares the security and usability of two password creation strategies—random word–based passphrases and user‐constructed complex passwords—using an experimental design with classroom participants. Grounded in guidance from modern authentication standards and prior human–computer interaction research, we examine memorability, creation and recall times, one-week retention, and estimated resistance to offline guessing. Participants memorized either a five-word diceware-style passphrase or a complex string that met typical composition rules. Immediate and delayed recall, error rates, and response latencies were recorded; theoretical entropy and simulated cracking success were estimated from policy-conformant models. Passphrases produced higher one-week recall, faster correct recall, and comparable or superior effective strength because user-created complex strings tended to embed predictable patterns that reduced entropy. The findings support length-first, composition-light policies with bans on common phrases, combined with two-factor authentication and password manager use.