These numbers are very rough estimates but give an idea of what length of passphrase a very powerful adversary like a state-sponsored attacker could guess.
You can see the details of our calculations in [[!tails_ticket 19615]] and this [spreadsheet](https://cryptpad.disroot.org/sheet/#/2/sheet/view/KdOJLeuCsc4dS3vq-bHhFw6zByUSRJXsCcAkB-ERxtc/).
Using other password schemes give little guarantee over the strength of a password, even if it follows complicated password policies and validates on password strength meters.
For example, a [Dutch hacker logged into Donald Trump's Twitter account *twice*](https://www.washingtonpost.com/world/2020/12/17/dutch-trump-twitter-password-hack/)by guessing his passwords, despite that these passwords included several words, were more than 8 characters, and even had special characters. They were definitely not random enough: "*maga2020!*" and "*yourefired*".
To understand the maths behind password strength, watch [An information theoretic model of privacy and security metrics](https://media.libreplanet.org/u/libreplanet/m/an-information-theoretic-model-of-privacy-and-security-metrics/).Bill Budington from the EFF explains the concept of entropy and its implication on browser fingerprinting and password safety in accessible terms.
- [[If your passphrase has 4 random words or fewer|argon2id#4]] - [[If your passphrase has 5 random words|argon2id#5]] - [[If your passphrase has 6 random words or more|argon2id#6]]
