but passwords are typically not safe to use as keys for standalone security systems (e.g., encryption systems) that expose data to enable offline password guessing by an attacker. passphrases are theoretically stronger, and so should make a better choice in these cases. first, they usually are (and always should be) much longer—20 to 30 characters or more is typical—making some kinds of brute force attacks entirely impractical. second, if well chosen, they will not be found in any phrase or quote dictionary, so such dictionary attacks will be almost impossible. third, they can be structured to be more easily memorable than passwords without being written down, reducing the risk of hardcopy theft. however, if a passphrase is not protected appropriately by the authenticator and the clear-text passphrase is revealed its use is no better than other passwords. for this reason it is recommended that passphrases not be reused across different or unique sites and services.