The titles' passphrases are stored in their respective "Control" NCA.
These "Control" NCAs contain some files that start with "icon_" which are the title's icons and a "control.nacp" file which contains informations about the title (the title ID, the title name, the title version, etc...) including the title's passphrase.
To make it easier, I wrote a little homebrew that allows you to dump these "control" data very quickly without having to dump your whole nand.
So all you have to do is :
1- Download the homebrew here.
2- Go to the homebrew launcher and launch this homebrew.
3- Press the A button to dump all your titles' "contol" data.
Once done, on your SD card you'll have the extracted "control" data at <nro folder>/Controls/full/<title iD>/ with the "icon.jpg" and "control.ncap".
So now, to get your passphrase, you have to open the control.nacp file from your extracted title's "control" data with any hex editor, go to offset 0x3100 and copy your 0x40 bytes long passphrase as a string.
Note : If the passphrase is only a bunch of 0s, it probably means that your title doesn't use bcat