Passphrase
A passphrase is a secret made of several randomly chosen dictionary words joined by separators (diceware-style), designed to be easier to type and remember than a random character string of similar strength. Entropy comes from the size of the wordlist and the number of words: with a 2048-word list, each word contributes about 11 bits when chosen uniformly with a CSPRNG. Passphrases excel for human-entered account credentials stored in a password manager. They are a poor substitute for raw CSPRNG byte keys used as JWT HMAC signing secrets, where libraries expect opaque high-entropy key material rather than memorable phrases.
Why It Matters
Teams confuse “long enough to remember” with cryptographic strength. A six-word random passphrase can exceed many short character passwords in entropy while remaining usable when words are CSPRNG-chosen from a large list. Still, signing secrets and SESSION_SECRET values should be opaque CSPRNG output — use the Passphrase Generator for human passwords and the JWT or Session Secret generators for application keys. Document which secret type each environment variable expects so operators do not paste a memorable phrase into JWT_SECRET by mistake. Pair passphrases with a password manager for storage and autofill; never commit generated phrases to source control or shared chat logs.
Frequently Asked Questions
How many words do I need?
Six words from a 2048-word list is about 66 bits. Use eight or more for higher assurance, and always store the result in a password manager.
Is a passphrase a JWT secret?
Prefer not. Use CSPRNG bytes (hex/base64url) for JWT_SECRET. Passphrases are for human-entered passwords.
Does capitalizing words add much entropy?
A little, if applied randomly. Word count and wordlist size dominate strength. Do not rely on clever capitalization of a short phrase.
Continue
Related tools and reading on JWTSecrets.