http://www.schneier.com/blog/archives/2012/03/the_security_of_5.html http://www.lightbluetouchpaper.org/2012/03/07/some-evidence-on-multi-word-passphrases/ "The results are discouraging: by our metrics, even 5-word phrases would be highly insecure against offline attacks, with fewer than 30 bits of work compromising over half of users." TL;DR - passphrases are better than passwords, but they're far from perfect.