"Use a strong password" gets repeated so often that it stops meaning anything specific. What actually makes a password or passphrase hard to crack comes down to one thing: how much guessing an attacker has to do before they land on it. Length, character set, and predictability all feed into that number, and passwords and passphrases arrive at a good number through different routes.
What "strength" actually measures
A brute-force attacker isn't guessing your exact password -- they're working through a space of possible combinations. Every additional character in your password (from a large alphabet: upper, lower, digits, symbols) multiplies that space. Every additional word in a passphrase (from a large word list) does the same thing, just with a bigger "alphabet" per unit -- a whole word instead of a single character.
That's why a random 8-character password (mixed case, digits, symbols) and a random 4-word passphrase can land in a similar strength range even though one looks short and the other looks long. The math is about total entropy, not visual complexity.
Where passwords fall apart
Random character passwords are strong in theory but fragile in practice, because humans are bad at generating and remembering true randomness. Left to pick their own, people default to substitutions attackers already expect -- P@ssw0rd1, a name plus a year, a keyboard walk like qwerty123. These pass a naive "has a symbol and a number" rule while being trivial to guess with a dictionary-based attack. The fix isn't willpower, it's not generating your own -- a tool generates the randomness for you and you store the result.
Where passphrases win: memorability without weakening the math
A passphrase built from a proper word list (like EFF's Diceware list, not phrases you invent yourself) sidesteps the human-randomness problem differently. You're not trying to remember a string like xT9!qL2vR, you're remembering four or five unrelated words in order. The randomness still comes from the selection process, not from you -- but the output is something you can actually memorize and type without a manager, which matters for a small number of accounts you need real recall on (a device PIN backup, an encryption passphrase, a password manager's own master password).
The actual tradeoff
Passphrases are easier to recall and type on mobile keyboards; character passwords pack more entropy per character if length is constrained by a site's arbitrary max-length rule (some still cap at 16 or 20 characters, which quietly punishes long passphrases). If a site allows long inputs, a longer passphrase is often the more usable choice. If a site caps length aggressively, a dense random password gets more strength into fewer characters. Neither is universally better -- the failure mode to avoid is self-generated, memorable-to-you-but-guessable-to-a-dictionary strings, regardless of which format you pick.
For anything you're not memorizing by design, store it in a password manager and stop caring how it reads -- length and true randomness matter, not how it looks.
Generate either one, with the entropy handled for you: the Password Generator produces random character-based passwords with a strength meter, and the Passphrase Generator builds memorable phrases from the EFF Diceware word list.