How to Change a Passphrase Securely

Changing a passphrase securely means generating a new one locally with a cryptographically secure random number generator, verifying its entropy is sufficient for your threat model, and updating it in every place it was stored before deleting the old value. You should never reuse an old passphrase or derive a new one from it, as patterns allow attackers to guess the successor. The safest workflow is to generate the new secret offline, confirm it meets your strength requirements, and paste it into your accounts immediately.

Why Regular Passphrase Rotation Matters

Passphrases degrade over time not because they get weaker mathematically, but because the environment around them changes. A passphrase that was strong five years ago might now be vulnerable if the service it protects suffered a data breach, or if computing power has increased enough to make brute-force attacks feasible. Rotation is less about the passphrase itself and more about limiting the window of opportunity for an attacker who may have already captured the hash.

If you suspect a breach, rotation is mandatory. If you are simply practicing good hygiene, rotation reduces the risk of long-term exposure. However, frequent rotation of weak passphrases is counterproductive; users often pick predictable variations like "Password1" to "Password2." The goal is to replace a potentially compromised secret with a fresh, high-entropy one that shares no structural relationship with the previous version.

Choosing the Right Method: Random vs. Diceware

There are two primary ways to generate strong secrets: random character strings and multi-word passphrases. Random character strings, such as Xk9#mP2!qL7, offer high entropy per character but are difficult for humans to remember or type without error. They are ideal for machine-to-machine authentication or when you use a password manager that handles the entry for you.

Diceware passphrases use a list of common words combined randomly, such as correct horse battery staple. This method provides high entropy while remaining memorable and easy to type. For most human-facing accounts, especially those requiring manual entry or recovery, a Diceware passphrase is the superior choice. It balances security with usability, reducing the likelihood that you will write it down on a sticky note or reuse a simpler variant.

When to Use Which

Step-by-Step: Generating a New High-Entropy Passphrase

To generate a secure passphrase, you need a tool that uses a cryptographically secure random number generator (CSPRNG). Standard JavaScript Math.random() is not sufficient for security-critical applications because it is predictable. You want a generator that uses the browser’s native crypto.getRandomValues() or an equivalent OS-level source.

Let’s walk through generating a six-word Diceware passphrase using the EFF long wordlist, which contains 7,776 words. This specific wordlist is standard because it allows you to generate words using five six-sided dice, or digitally using a CSPRNG.

1. Select the Mode: Choose "Diceware" or "Passphrase" mode.
2. Set Word Count: Select six words. This is the baseline for strong security in most modern contexts.
3. Choose Separator: Use a hyphen (-) or a space. Hyphens are often safer because they prevent ambiguity when typing (e.g., "nowhere" vs. "now here").
4. Generate: Click the generate button. The tool should display the passphrase and its entropy in bits.

For example, if you generate six words from a 7,776-word list, the entropy is calculated as $\log_2(7776^6)$. Since $7776 = 6^5$, this is equivalent to rolling 30 dice. The entropy is approximately 77.5 bits.

A sample output might look like this:

correct-horse-battery-staple-correct-horse

Note: This is a placeholder for illustration. Your actual output will be random.

Verifying Strength with Entropy Metrics

Entropy is the measure of unpredictability in your secret. It is expressed in bits. To verify strength, you must understand how the entropy is calculated for passphrases.

For a Diceware passphrase, the formula is:

$$ \text{Entropy (bits)} = \text{Number of Words} \times \log_2(\text{Wordlist Size}) $$

Using the EFF wordlist (7,776 words):

• $\log_2(7776) \approx 12.925$ bits per word.
• 4 words: $4 \times 12.925 \approx 51.7$ bits. (Too weak for high-value accounts).
• 5 words: $5 \times 12.925 \approx 64.6$ bits. (Minimum acceptable for many uses).
• 6 words: $6 \times 12.925 \approx 77.5$ bits. (Strong).
• 7 words: $7 \times 12.925 \approx 90.5$ bits. (Very strong).

When you generate a passphrase, look for the entropy display. If it shows roughly 77 bits for six words, the math checks out. If it shows significantly less, the tool may be using a smaller wordlist or introducing bias.

Checking for Breaches

Before finalizing the new passphrase, check if it has appeared in known data breaches. A secure tool will do this locally or using a k-anonymity protocol, where only a prefix of the password’s hash is sent to the server. This ensures your full password never leaves your device. If the tool indicates the passphrase is "clean," you can proceed. If it is "breached," generate a new one.

Safely Updating Your Secrets Manager

Once you have a verified, high-entropy passphrase, the next step is updating your secrets manager. This is the most critical phase because it is where human error often occurs.

1. Open Your Manager: Log in to your password manager or secrets vault.
2. Locate the Entry: Find the account for which you are rotating the passphrase.
3. Paste, Don’t Type: Copy the new passphrase from the generator and paste it directly into the "Password" or "Passphrase" field. Typing introduces the risk of typos, which can lock you out or create a weaker password than intended.
4. Verify: Re-paste the value into the "Confirm Password" field. If they match, the entry is correct.
5. Save and Sync: Save the entry and allow it to sync across your devices.

If you are managing multiple credentials, consider using bulk generation. You can generate 10–20 passphrases at once, copy them into a secure temporary file, and update your accounts one by one. This is more efficient than generating each one individually.

PasswordForge supports this workflow by allowing you to generate Diceware passphrases with real-time entropy display and bulk export options, ensuring you can rotate credentials without leaving the security of your local browser.

What to Do With the Old Passphrase

After updating the new passphrase, you must ensure the old one is no longer usable. If the service allows you to change the password, the old one is automatically invalidated. However, if you have stored the old passphrase in other places—such as a backup file, a note-taking app, or a secondary password manager—you must delete it.

Do not keep a history of passphrases unless your manager explicitly supports versioning and you have a specific reason to retain them. Stale secrets are a liability. If you suspect the old passphrase was compromised, also check for active sessions on that account and revoke them. This forces any unauthorized user to re-authenticate with the new passphrase, which they do not have.

Final Checks Before Closing

Before you close the generator and move on, perform a quick sanity check. Ensure the new passphrase is not a variation of your old one. Ensure it is not a common phrase or a quote from a movie. Ensure it is stored in your secrets manager and not in an unprotected text file on your desktop.

If you are using a hardware key or multi-factor authentication (MFA) alongside the passphrase, verify that these factors are still active and linked to the correct account. Changing a passphrase does not reset MFA, but a misconfiguration during the update process can sometimes disrupt it.

By following this local-generation, verification, and secure-update workflow, you ensure that your new passphrase is both strong and correctly deployed, minimizing the risk of exposure during the rotation process.