Custom password or generated: which is smarter?
The two schools of thought
There are two camps when it comes to creating passwords. One believes in crafting memorable passwords that you can actually recall — choosing a phrase, a pattern, or a combination that means something to you. The other argues that any human-created password is inherently predictable and that true randomness should always be delegated to a machine.
Both camps have a point. The right answer depends on what the password is for.
Why generated passwords are generally stronger
When a password generator creates a credential, it draws from a pool of characters using a cryptographically secure random process. There is no pattern, no bias, no underlying meaning. A 20-character random string has roughly 10^38 possible values — far beyond what any brute-force attack could realistically explore.
When a human creates a password, even with the best intentions, patterns emerge. We reach for words we know, numbers that are significant to us, and structures that make the password feel logical. Those patterns dramatically reduce the effective search space for an attacker who knows how humans think about passwords.
When custom passwords make sense
Generated passwords are ideal when you have a password manager to store and autofill them. You never need to type or remember a 20-character random string — the manager does it for you.
But there are credentials you genuinely need to remember and type, without a manager's help:
- The master password for your password manager itself
- Your device login password or PIN
- A work account that you access from multiple devices without manager access
For these cases, a long passphrase is often better than a short generated string. Four or five genuinely random, unrelated words — chosen by rolling dice or using a wordlist, not by thinking of words yourself — give you good entropy and something a human can actually hold in memory.
The key is "genuinely random." "CorrectHorseBatteryStaple" became famous as an example, which means it's now in every dictionary attack. Generate your own.
When it comes to sharing
The custom vs. generated debate takes an interesting turn when passwords need to be shared. For shared accounts — a team social media login, a shared admin credential — generated passwords are almost always the better choice:
- They can't be guessed by people who know the team
- No one can reconstruct them from personal information
- They signal to everyone on the team that the credential was deliberately created for this purpose
When sharing a generated password with a colleague or client, use PassTransfer to send it as a one-time encrypted link. A strong generated password sent carelessly via email offers less real protection than a simpler password sent through a secure channel. Both the credential quality and the delivery method matter.
The practical recommendation
For 95% of credentials: use a password manager, let it generate strong random passwords, never think about it again.
For the small number of credentials you need to remember: use a passphrase of genuinely random words — long enough to be strong, human enough to be memorable.
For any credential you need to share: generate a strong random password and deliver it via a one-time encrypted link.
Conclusion
Generated passwords win on raw security. Custom passphrases win on memorability for the handful of credentials that must live in your head. For everything else — including any credential that needs to travel from you to someone else — automate the creation and secure the delivery.
