The point of a passphrase is to <i>randomly</i> generate each word in the phrase.<p>Even Diceware, which uses a list of 7776 words, is resistant to attacks if you have a 7 word passphrase.<p>You use your long random passphrase to protect your password safe.  The passwords in your safe are long randomly generated strings of lower case, upper case, digits, and special chars.<p>&gt; But you’re forgetting the massive GPU array. The hacker runs a program that generates random combinations of two, three or four dictionary words and tries it against your password hash. It’s going to take a while because the number of such combinations are very large, but it’s not impossible. If the hacker is really obsessive about it, he will just keep the program running for weeks until a match is found.<p>No one today recommends 4 word passphrases - 7 word is the minimum.  But 4 words is probably better than most passwords that people use at the moment.