Passphrase Strength and Security Recommendations
No matter how strong AES-256-GCM is, the entire security of your encrypted text rests on the passphrase you select. Attackers who obtain a ciphertext will almost certainly attempt to guess the passphrase rather than break the mathematics of the cipher. A weak passphrase turns an unbreakable algorithm into a trivial lock to pick. Fortunately, following a few straightforward rules makes guessing infeasible even with massive computing resources.
Length is the most important factor. Each additional character dramatically increases the number of possible combinations. A twelve-character random string already provides far more security than an eight-character password with mixed case, numbers, and symbols. Even better are longer passphrases made of multiple common words. A sequence of five or six unrelated words chosen randomly—often called a diceware passphrase—can reach extraordinary strength while remaining memorable.
Avoid Common Pitfalls
Never use single dictionary words, names, birthdays, keyboard patterns, or repeated characters. These are the first things password-cracking tools try. Also avoid substituting letters with similar-looking numbers or symbols, as modern cracking software accounts for those predictable changes. Do not reuse the same passphrase for multiple encrypted messages or combine it with other accounts. Unique passphrases per message provide excellent compartmentalization.
Using a Password Manager
The easiest way to generate and remember strong passphrases is with a reputable password manager. Most good managers can create long random strings or diceware-style phrases with a single click. Store the passphrase there rather than writing it down or memorizing it insecurely. When sharing encrypted content, send the passphrase through a different secure channel, such as an encrypted messaging app or in person.
The tool requires at least eight characters to discourage very weak choices, but real protection starts at fifteen characters or more. With a twenty-character random passphrase or a six-word diceware phrase, even nation-state attackers with enormous resources would need billions of years to guess it through brute force.
Remember that the salt and high PBKDF2 iteration count add extra protection against offline guessing. Every extra second of delay per guess multiplies the attacker’s effort. Combine strong passphrases with safe handling of ciphertexts, and your messages remain extremely well protected.
The final article in this series explains what different decryption error messages mean and how to troubleshoot common issues.