Passphrases are not passwords and I think they shouldn't be recommended for use as passwords.
Passphrases are fantastic for encryption keys, where trying to otherwise memorise a suitable amount of entropy to match the required strength would be almost impossible.
But passwords don't need to be 256 bit. If you're using a password manager it doesn't hurt to keep passwords as strong as each service will allow, but Diceware isn't the right tool for the job for passwords, because while it's great for memorizing one or two high entropy phrases, there's no way someone could be expected to memorize the dozens of passwords they use on a daily basis.
At which point you're back to bad solutions such as writing it down, using the same phrase everywhere or cheating on the lengths.
The only sane way to manage dozens of services in a way that doesn't bleed risk from one service compromise to the next is password managers.
At which point a 16-20 character password of random characters is more suitable than a passphase. It's harder to memorize if anyone happens to see it due to a miss-paste or whatever, it's easier to type in if you need to and it's less likely to suffer from "silent truncation" effects.
So use a password manager, use a diceware phrase to secure the master password (encryption) there, but allow the password managers to generate passwords which are short and random.
Comments
Diceware is great for passphrases.
Passphrases are not passwords and I think they shouldn't be recommended for use as passwords.
Passphrases are fantastic for encryption keys, where trying to otherwise memorise a suitable amount of entropy to match the required strength would be almost impossible.
But passwords don't need to be 256 bit. If you're using a password manager it doesn't hurt to keep passwords as strong as each service will allow, but Diceware isn't the right tool for the job for passwords, because while it's great for memorizing one or two high entropy phrases, there's no way someone could be expected to memorize the dozens of passwords they use on a daily basis.
At which point you're back to bad solutions such as writing it down, using the same phrase everywhere or cheating on the lengths.
The only sane way to manage dozens of services in a way that doesn't bleed risk from one service compromise to the next is password managers.
At which point a 16-20 character password of random characters is more suitable than a passphase. It's harder to memorize if anyone happens to see it due to a miss-paste or whatever, it's easier to type in if you need to and it's less likely to suffer from "silent truncation" effects.
So use a password manager, use a diceware phrase to secure the master password (encryption) there, but allow the password managers to generate passwords which are short and random.