Secure Passphrase Generator
Create memorable but strong passphrases (Diceware style).
Number of Words
4
Separator
Why use a passphrase?
Passphrases like "correct-horse-battery-staple" are much easier for humans to remember than random strings like "Tr0ub4dor&3", while being harder for computers to crack due to their extreme length and high entropy.
How to use the passphrase generator
- Choose the number of words (3–8). Five words is a good minimum for online accounts; use six or more for a password manager master password or disk encryption.
- Pick a separator: hyphen, dot, space or underscore.
- Optionally capitalise words or include a number to satisfy sites that demand mixed character types.
- Press Generate until you get a phrase you can picture, then copy it.
Why passphrases work
A passphrase is a password made of several randomly chosen words, like sprout-ladle-marina-unwind-cobalt. The idea, popularised by the Diceware method, is that a long string of random words is both easier to remember and harder to crack than a short jumble like Tr0ub4dor&3.
The security comes from the randomness of the choice, not from the words being obscure. This generator picks each word from the EFF large wordlist of 7,776 words using your browser's cryptographically secure random number generator, with no bias toward any word. Each word therefore adds about 12.9 bits of entropy, even if an attacker knows exactly which list was used.
| Words | Entropy | Suitable for |
|---|---|---|
| 4 | ≈ 51.7 bits | Low-value accounts with rate-limited logins |
| 5 | ≈ 64.6 bits | Most online accounts |
| 6 | ≈ 77.5 bits | Email, password manager master password |
| 7–8 | ≈ 90–103 bits | Disk encryption, crypto wallets, offline-attackable secrets |
Tips for remembering a passphrase
- Build a silly mental picture linking the words in order.
- Type it out several times on the day you create it, and again the next day.
- Don't rearrange or swap words for ones you like better: human choices are predictable and reduce the strength.
- Keep a written copy in a safe place until it's committed to memory.
Frequently asked questions
Isn't a password made of dictionary words easy to crack?
Not when the words are chosen randomly and there are enough of them. A dictionary attack has to try every combination: with 7,776 words and six words there are about 2.2 × 1023 possibilities.
Do capitals and numbers make it much stronger?
Only slightly. They mainly help you meet website rules. Adding one more word is worth far more.
Where does the word list come from?
It is the EFF Large Wordlist for passphrases, published by the Electronic Frontier Foundation under a Creative Commons Attribution licence. Its words were chosen to be memorable and easy to type.