Passcode vs passphrase: which one protects you better, and when

Two different defences

Both unlock something. They are safe for different reasons.

• A passcode is short, and the lock guards it. Six digits have only a million possible values. What makes that enough is the lock: it counts wrong tries and makes the guesser wait longer and longer.
• A passphrase is long, and guards itself. Six random words from a long list have so many combinations that even a guesser with no waits at all can’t get through them.

So the first question is never “which is stronger?” It is: who counts the tries?

When a passcode is enough

A passcode fits when the thing that checks it can’t be copied away from its guard. Your phone is the plain example. Apple says the passcode is tied to the device’s own key, one try takes about 80 milliseconds, and waits grow after wrong entries. A guesser has to sit with your phone and type.

An app lock with its own waits works the same way. In Sealed, By default, after three wrong passcodes in a row Sealed locks entry for 30 seconds, then for 1, 5, 15 and finally 60 minutes after each further wrong try. Sealed keeps the wrong-try count and the wait when you close it and open it again, and the count clears only after a correct unlock or a passcode reset with your recovery key.

Here, a code you can type in two seconds is the right tool. A long phrase would only tempt you to turn on looser settings.

When you need a passphrase

A passphrase fits when someone could get a copy and guess at their own speed, with no one counting. Examples:

1. An encrypted file you send or store elsewhere, such as a password-locked archive or backup.
2. A key you keep in an email or cloud account, in locked form.
3. The one password that opens a password manager.
4. Any lock where the stored data is the only barrier, not a device.

These locks usually make each guess slow on purpose (see what key derivation is), but the phrase still has to carry most of the weight. Short codes run out.

How they compare

The passcode column follows Apple’s description of how a phone guards its code.

Making each one better

For a passcode: choose six digits or more, avoid birthdays and patterns, and turn your screen away when you type. On an iPhone, Passcode Options lets you switch to a longer numeric or alphanumeric code. The passcode guessing guide has the worked numbers.

For a passphrase: let chance pick the words, use enough of them, and keep them as they came. The passphrase guide walks through it. Then decide where the written copy lives before you rely on it.

Where Sealed helps, and where it doesn’t

It helps with a passcode guarded by waits that don’t reset when you close the app. Sealed keeps the wrong-try count and the wait when you close it and open it again, and the count clears only after a correct unlock or a passcode reset with your recovery key. Sealed’s default passcode is 6 digits, and you can choose 4 or 9 digits or a password instead.

It helps with an optional passphrase on top, for when an unlocked phone shouldn’t be enough. With a vault passphrase on, you enter your passcode or pattern first and then type the passphrase, and a wrong passphrase counts as a wrong try. 12 characters The vault passphrase page shows it.

It doesn’t stop someone who saw you type your code. Your passcode is a gate in front of the app. It is not part of the key.

It doesn’t offer a reset for a lost passphrase, beyond your recovery key. With a vault passphrase, your vault key is sealed under a passphrase you type every time the vault unlocks, and if you lose it only your recovery key opens the vault. The vault passphrase is part of Sealed Pro.