What if you randomly generated 3 or 4 words for each passphrase? Feels like that's decently strong against brute force...