Passphrase Generator_
A passphrase generator that shows its working. Pick how many words you want and the tool draws them from the 7,776-word EFF list with your browser's cryptographic randomness — then prints the entropy as a sum you can check, term by term, instead of a coloured bar you have to believe.
Free, no account, no vault to sign up for. Six words is 77.5 bits and three seconds of typing.
| Term | Arithmetic | Bits |
|---|
Wordlist: the EFF large wordlist, 7,776 words, 12.925 bits each. Created by the Electronic Frontier Foundation and used under CC BY 3.0. It ships with the page.
How to use
- 01Set the number of words. Six is the default and the usual advice; the strong passphrase generator arithmetic is in the table under the output, so you can pick a number rather than accept one.
- 02Choose a separator. Hyphens type quickly, spaces read best, and none is safe here for the reason above — this list has no word that is a prefix of another.
- 03Add capitalisation or a character only if a system forces you to. The readout will show you honestly that capitalising every word buys nothing.
- 04Read the entropy sum. That is the free passphrase generator part that most tools skip: not a rating, an addition you can repeat yourself.
- 05Copy it straight into your password manager. Ask for up to 50 at once if you are setting up several accounts — this secure passphrase generator draws each one independently.
Words, bits, and what each level actually resists
| Words | The arithmetic | Entropy | What that resists |
|---|---|---|---|
| 3 | 3 × 12.925 | 38.8 bits | Almost nothing offline. Fine for a throwaway forum login, nothing you would mind losing |
| 4 | 4 × 12.925 | 51.7 bits | Rate-limited online guessing. Not an offline attack on a leaked hash |
| 5 | 5 × 12.925 | 64.6 bits | A serious hobbyist with a GPU. The point where it stops being casual |
| 6 | 6 × 12.925 | 77.5 bits | Offline cracking by a well-funded attacker. The usual recommendation, and the default here |
| 7 | 7 × 12.925 | 90.5 bits | Comfortable margin against future hardware for a long-lived secret |
| 8 | 8 × 12.925 | 103.4 bits | Full-disk encryption, a password-manager master key, anything you cannot rotate |
| 12 | 12 × 12.925 | 155.1 bits | Past every practical threat. Choose this only if you genuinely enjoy typing |
Each row is a multiplication, not an estimate. Time-to-crack figures are deliberately absent: they depend on the attacker's hardware and on how the site stored your secret, neither of which this page knows.
Passphrase or password? The same strength, two different costs
| Compared on | Passphrase (this page) | Password (character string) |
|---|---|---|
| Roughly 77 bits needs | 6 words | 12 characters from a 94-character pool |
| Typical length | 34 characters | 12 characters |
| Keystrokes | More, but all lowercase letters and one separator | Fewer, but with shift, symbols and digits interleaved |
| Typing on a phone or TV remote | Slow but reliable — no keyboard switching | Painful; symbols live two layers deep |
| Memorising it | Realistic. Six concrete nouns form a picture | Not realistic. This is why people write them down |
| Dictating it over the phone | Possible | Miserable |
| Where it breaks | Length caps and fields that reject spaces | Sites that reject particular symbols |
| Best for | The handful you must type from memory | Everything your manager fills in for you |
The decision is usually not which is stronger — at equal bits they are equal — but which one you will be typing by hand. Most people need two or three passphrases and a few hundred passwords.
Where passphrases go wrong
A symbol buys far less than a word
Adding a digit at a random boundary is about 6.1 bits; adding a symbol from a small set is about 4.8. Another word is 12.925. The decoration exists because some login forms demand a non-letter, not because it makes you meaningfully safer — and the readout above shows you the difference the moment you switch it on.
Editing it to be memorable destroys the point
Swapping a word you dislike for one you like, or reordering the words so they make a sentence, replaces a random draw with your own taste. Your taste is predictable and shared with millions of other people. If a passphrase is hard to remember, generate another — that costs nothing and keeps the arithmetic true.
Long is not the same as random
A twelve-word line from a song you love is long and worth close to nothing, because the attacker is guessing lyrics rather than words. The entropy here is real only because a machine drew the words from a fixed list. Words you picked yourself carry the entropy of your own habits, which nobody can measure and which is always lower than it feels.
Some systems will not let you use one
Length caps of 16 or 20 characters are still common, and a few fields silently truncate rather than refusing — so you set a 34-character passphrase and a 20-character one is what actually got stored. Others reject spaces. Where you hit that, drop to five words with a hyphen, or use a character password and let a manager type it.
Reusing it cancels the strength entirely
A 77-bit passphrase used on two sites is exactly as strong as the weaker site’s database. Entropy protects you against guessing; it does nothing whatever against a breach somewhere you also used it. The reason to generate rather than remember is that you only need a handful — the master key, the disk, the machine you log into.
The separator can hide inside a word
Four entries in this list contain a hyphen: drop-down, felt-tip, t-shirt and yo-yo. With the hyphen separator, splitting the result no longer recovers the original words, which matters if you are scripting around the output. It costs no strength, and the tool says so when it happens rather than leaving you to find out.
When to reach for one
The password-manager master key
The one secret the manager cannot store for you. It has to live in your head and be typed on days when you are tired, so buy margin with words rather than symbols.
Words: 8 · separator: hyphen Capitalisation: none
plaything-showroom-anchovy-district-eggshell-unopened-radiator-crushable
Disk encryption
Typed at a boot prompt with no password manager and often an unfamiliar keyboard layout. Lowercase words and a hyphen survive that; a symbol-heavy string does not.
Words: 7 · separator: hyphen Capitalisation: none
jawbone-scarecrow-unbaked-plotted-hexagon-immersion-rundown
A wifi key for guests
Read aloud or copied off a whiteboard. Words are unambiguous spoken in a way no character string is, and spaces read best on a printed card.
Words: 5 · separator: space Capitalisation: none
trombone rekindle carnation dwindle sandpaper
Getting more out of it
- Generate a few and pick one you can picture. Choosing among generated candidates costs you log2(how many you looked at) — about 2.3 bits if you rejected five. That is a real cost but a small one, and unlike editing the words it does not concentrate your choice anywhere an attacker can predict.
- Write it down while you learn it, somewhere physical, and destroy the note once it sticks. A passphrase you forget is a lockout; a paper note in your home is a threat model most people are not actually facing.
- If a field rejects it, count characters before you blame the spaces. A six-word passphrase averages 34 characters, and a silent 20-character cap is a commoner cause than a space restriction.
- Set the quantity to 50 when you are provisioning several machines or accounts at once, then Copy takes the whole batch as separate lines.
- Use the password generator for anything a manager will fill in, and keep passphrases for the few secrets you type yourself.
Technical details
- Wordlist
- EFF large wordlist, 7,776 words, 12.925 bits per word. CC BY 3.0, Electronic Frontier Foundation. Shipped with the page and verified on every test run for count, duplicates, character set and the prefix-free property
- Randomness source
crypto.getRandomValues— the browser CSPRNG, seeded from OS entropy — with rejection sampling, so the 7,776-word range carries no modulo bias- Entropy
- Recomputed from the actual configuration on every change and shown term by term. Capitalising every word contributes 0; capitalising one contributes log2(words); an inserted character contributes log2(choices × positions)
- Limits
- 3 to 12 words, 1 to 50 passphrases at a time. Both bounds are checked before anything is drawn
- Storage
- Nothing is written anywhere. No localStorage, no sessionStorage, no cookie, no URL state — reload the page and every passphrase it made is gone
- Network
- None from tool code. A test sweep calls every function this page uses with
fetchandXMLHttpRequestreplaced by stubs that throw, so a stray request fails the build instead of shipping. Disconnect from the network and the page still works.
Frequently asked questions
How many words do I actually need?
Six, for anything that matters, which is 77.5 bits and the figure EFF itself recommends. Go to eight for a password-manager master key or a disk you cannot re-encrypt easily. Below five you are relying on the site rate-limiting attempts, which you cannot verify from outside.
Is this the same as diceware?
Yes, with the dice automated. Diceware means five dice indexing a 7,776-entry list; this draws the same index from the browser's cryptographic generator instead. Same list size, same bits per word, same arithmetic — you could reproduce any of these by hand with five dice and the published list.
Can I use this for a 24-word crypto wallet seed phrase?
No, and you should not want to. A wallet seed is BIP-39: a fixed 2,048-word list with a checksum built into the final word, so an arbitrary 24 words from this list is not a valid seed. Generate a wallet seed on the wallet device itself, where the secret never touches a browser at all.
Why not offer the shorter EFF lists?
EFF also publishes two 1,296-word lists at 10.339 bits per word, one of which gives every word a unique three-character prefix so autocomplete is safe. They are good lists. Offering all three would put a "which list?" qualifier on every number here, and making those numbers legible is the entire point of this page — so it ships one list and names the others so you can go and get them.
Does my passphrase leave the browser?
No, and for a credential generator that is the whole question — one that mints your secret on a server has, by construction, held it. The work is JavaScript running in this tab. Every function it calls is covered by a test that stubs fetch and XMLHttpRequest to throw, so a request that slipped in would break the build rather than reach a server — and you can confirm it for yourself by disconnecting and carrying on.
Does capitalising the words help?
Not if you capitalise all of them — that adds exactly zero bits, because it happens to every passphrase this tool produces and so narrows nothing down for an attacker. Capitalising one random word does add log2(words), around 2.6 bits at six words, since the position is drawn. Neither is worth much; the control exists for login forms that insist on an uppercase character.
Is 50 at once safe, or do they share randomness?
Each of the 50 is drawn independently from the same cryptographic source, word by word — there is no shared seed and no derivation of one from another. The tool also makes no attempt to force them to be distinct, because rejecting duplicates would bias the distribution; at 77 bits a collision among 50 draws is not something you will see.
Should I change the words to ones I like better?
No. The moment you choose, the entropy figure above stops being true, because it measures a machine drawing uniformly from a list and not a person picking words they find pleasing. Regenerating is free; do that instead.
Why a passphrase is a different bet from a password
A passphrase is several words picked at random and stuck together. That is the whole idea, and the reason it works is a piece of arithmetic rather than a trick. Each word is drawn from a list of 7,776 candidates, so each word contributes log2(7,776) = 12.925 bits of uncertainty. Six words is 6 × 12.925 = 77.5 bits. Nothing about that number depends on the words looking impressive; it depends only on the size of the list and on the draw being genuinely random.
The comparison people actually want is against a shorter, nastier string. A random 12-character password over the usual 94 printable characters is 12 × log2(94) = 78.7 bits — very slightly stronger than our six words, and vastly harder to hold in your head or type on a television remote. That is the trade in one line: roughly the same resistance to an attacker, an enormous difference in what it costs you to use. Where you need the character-string kind instead, the password generator does that job with the same audited randomness.
What the xkcd comic actually argued
People search for a passphrase generator xkcd because of strip 936, "Password Strength", and the phrase correct horse battery staple. The argument in it is frequently misquoted as "four words is enough". What the comic actually says is subtler and more interesting: through twenty years of effort we trained everybody to choose passwords that are hard for humans to remember and easy for computers to guess. The villain is the substitution ritual — Tr0ub4dor&3 — which feels clever, adds almost no uncertainty, and costs a great deal of memory.
Its arithmetic deserves care too. The comic puts four words at 44 bits, which implies a list of 211 = 2,048 words. Our list is nearly four times larger, so four words here is 51.7 bits, not 44. Neither figure is wrong; they describe different lists. This is exactly why a generator that will not name its wordlist cannot justify the number it prints, and why the credit line above the fold names ours.
What Bitwarden's generator does, and what it leaves out
The other common search is for the bitwarden passphrase generator, which offers four controls: how many words, which character separates them, whether to capitalise, and whether to include a number. Those are sensible controls and this page has the same ones. What that tool — and 1Password's equivalent, and most of the rest — does not do is tell you what each control is worth. It shows a qualitative meter.
The numbers matter because they are counter-intuitive. Capitalising every word adds exactly zero bits: it happens to every passphrase identically, so it removes no uncertainty from an attacker's search. Dropping a digit in at a random word boundary adds about 6.1 bits. Adding one more word adds 12.925. If you find yourself decorating a passphrase to make it feel stronger, the honest move is almost always to delete the decoration and add a word instead. Our readout recomputes on every change and shows which term contributed what, so you can watch that happen rather than take it on trust.
Where "diceware" comes into it
Diceware is Arnold Reinhold's 1995 method: roll five ordinary six-sided dice, read the five digits as a lookup into a numbered list, repeat. Five dice give 65 = 7,776 outcomes, which is why the list is exactly that long and why every diceware-compatible list since has been the same size. The EFF published replacement lists in 2016 with the same 7,776 entries but words chosen to be easier to type and to recall — no punctuation-only entries, no obscure abbreviations. This page is diceware with the dice replaced by crypto.getRandomValues; the list and the arithmetic are unchanged, so you can check any passphrase it produces against a physical roll if you want to.
One property of this particular list is worth knowing because it changes what the separator is for: no word in it is a prefix of any other word. That means a passphrase run together with no separator at all still decodes to exactly one sequence of words. So choosing "none" costs you nothing in strength — it is purely a question of what is comfortable to read and type.
Can you trust a generator you found on the web
It is the right question to ask, and it has a sharper edge for a generator than for most tools. A formatter sees data you already had; a generator creates the secret, which means at the instant of creation the machine doing the work holds a credential that does not exist anywhere else yet. If that machine is a server, the secret has been on somebody else's hardware before it was ever yours, and no privacy policy can undo that — it is a property of where the code ran, not of what anyone promises afterwards.
Two things make that checkable rather than a matter of faith here. The words are drawn by JavaScript in your own tab, so you can open the network panel, generate a hundred passphrases, and watch nothing go out. And you can disconnect entirely — pull the wifi, then keep generating — which is a test no server-backed tool can pass. If you would rather not rely on either, the method is public: five dice and the published list produce the same distribution, one word per five rolls.
How many words is the right number
The question behind most searches for a random passphrase generator is really "how many words is enough", and the honest answer is that it depends on one thing: whether an attacker can guess offline. If your secret is only ever checked by a server that locks the account after ten wrong attempts, four words is already far beyond reach. If the site is breached and the attacker walks away with a file of password hashes, they can guess as fast as their hardware allows, and the only thing standing between them and your account is the number of words you chose and how expensively the site hashed it — which you have no control over and no way to inspect.
So the sensible rule is to plan for the breach, because it is the case you cannot influence. Six words is the usual recommendation, EFF's included, and it is the default here. Move to seven or eight for the small number of secrets you cannot rotate quickly — a disk you would have to re-encrypt, a password manager holding everything else. Going past that is not wrong, just unnecessary: at twelve words you are at 155 bits, and the weakest part of your setup stopped being the passphrase a long way back.
Remembering one, and what to do when you cannot
Memorisation works better than people expect, and it works for a specific reason: the words are concrete. Most entries in this list are objects and actions you can picture, which is what makes six unrelated ones stick after a handful of typings when a twelve-character string never does. The technique that actually helps is to build one absurd scene containing all six items in order and to picture it rather than to recite the letters. Type it from memory a few times the same day, then again the next day, and it is usually yours.
What does not work is fighting a passphrase you dislike. If a draw comes up with three words you keep stumbling over, press Regenerate. The cost of looking at a few candidates and taking one is roughly log2 of how many you looked at — around two bits if you rejected four — and that is a genuine cost, but a tiny one next to 77. It is also fundamentally different from editing the words, because rejecting a whole draw does not push your choice toward anything an attacker can anticipate, whereas swapping "unopened" for "kitten" pushes it exactly where everyone else's swaps go.
And for everything else, do not memorise at all. You need two or three passphrases in total: the manager, the machine, the disk. Every other account should hold a long random string you never see, generated by the password generator or by the manager itself, because a secret nobody remembers cannot be reused by accident — and reuse, not weakness, is how most accounts are actually lost.