Conservatively consider a dictionary of the 2 , 000 most common words . An effectively random selection of 4 words from this list has a 20004 chance of being randomly guessed , which is 4 log 2 2000 44 bits of entropy 244 possibilites . Now consider the set of case sensitive alphanumeric characters , which has 62 elements 226 10 . To get the equivalent 44 bits of entropy , you need 8 characters . 4 dictionary words is at least as secure as 8 casesensitive alphanumeric characters . The former is easier to remember . The now classical example is CorrectHorseBatteryStaple , compared to something like zffgIDf 1 generated via random . org . Remember that the initial dictionary of 2 , 000 common words is a conservative case which assumes the attacker has the list of those words . With a bigger list you gain more security and lose memorability if the attacker doesn ' t have your list you have more security with no tradeoff . Random characters are in general more secure by character length but harder to remember .