An Observation About Passphrases: Syntax vs Entropy

TL;DR

This paper examines whether syntactically correct passphrases are more secure than randomly ordered word collections, concluding that syntax has negligible impact on security within multi-word English passwords.

Contribution

It provides an analysis isolating the effect of syntax on passphrase security, showing minimal difference compared to random arrangements.

Findings

Syntax does not significantly affect passphrase security.

Randomly arranged word collections are as secure as syntactically correct passphrases.

Focus is limited to multi-word English passphrases, excluding other password types.

Abstract

On the premise that we are using passwords composed of multiple English words, we argue that using syntactically correct passphrases has no significant impact on the security in comparison to randomly arranged collections of words. We only analyze the contribution of the syntax itself. A comparison to the other kinds of passwords is out of the scope.