Passphrase
A passphrase is a password made of several ordinary words strung together, such as three random words, which is long and hard to guess but easy to remember. Cyber Essentials encourages it: the requirements recommend promoting passwords of at least three words, citing the NCSC's three random words guidance. It also makes the 12-character option easy to reach.
- Term
- Passphrase
- Also known as
- Three random words, Multi-word password
- Category
- Accounts and access
- Requirement area
- 4. User Access Control
- Questions
- A7.12
- Reviewed against
- Requirements v3.3
What does the term passphrase mean in Cyber Essentials?
A passphrase is a password made of several ordinary words strung together, such as three random words, which is long and hard to guess but easy to remember.
How does passphrase apply to Cyber Essentials?
In plain terms
Instead of something short and fiddly with swapped letters and symbols, you pick three words that have nothing to do with each other and put them together. The result is long, which makes it slow to guess, and it forms a picture in your head, which makes it easy to remember. Avoid song lyrics, famous quotes and words linked to you, such as your children's or pets' names.
What Cyber Essentials asks
The NCSC requirements list ways to "Support users to choose unique passwords for their work accounts". One is "encouraging people to choose longer passwords by promoting the use of multiple words (a minimum of three) to create a password", with the NCSC's guidance on three random words given as the example.
Two other support measures fit well with passphrases: "not enforcing regular password expiry" and "not enforcing password complexity requirements". A good passphrase does not need symbols or capitals to be strong.
Passphrases also help with the quality rules at A7.11. Three ordinary words usually pass the 12-character minimum, which is one of the three accepted options, with no maximum length allowed.
What an assessor looks for
A7.12 asks: "Please explain how you encourage people to use unique and strong passwords." Say how staff are told about three random words, for example at induction or in a short policy, and pair it with a password manager so each passphrase is used once only.
See the Cyber Essentials password rules and A7.12. Related: password, password manager, brute-force attack.
Related terms
- PasswordA password is a secret string of characters that you type to prove you are the person an account belongs to.
- Password managerA password manager is an app that stores all your passwords in one locked, encrypted place and can create strong new ones for you, so you only need to remember one.
- Brute-force attackA brute-force attack is an attempt to get into an account by guessing passwords over and over, usually with software that tries thousands of combinations automatically.
- Passwordless authenticationPasswordless authentication is a method to establish a user's identity that uses a factor other than knowledge, such as FIDO2 authenticators, biometrics, security keys, one-time codes, QR codes or push notifications.
- Privileged accessPrivileged access is any level of access above that of a normal user, such as admin rights that let someone change settings, install software or see everyone's data.
- Service accountA service account is a login used by a program or automated process, rather than by a person, for example the account a backup tool uses to reach your files.
Frequently asked questions
A passphrase is a password made of several ordinary words strung together, such as three random words, which is long and hard to guess but easy to remember.
In the 2026 Danzell question set, passphrase comes up at A7.12. Read those questions against the definition above so your answers use the term the way the assessor will.
Passphrase relates to 4. User Access Control in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.