Passphrase Generator

How to use Passphrase Generator

1. Pick how many words you want. Five is a good minimum, and six or more is better for important accounts.
2. Choose a separator and, if a site demands it, capitalise words or add a number.
3. Press New passphrase until you have one you like, then copy it.
4. Store it in a password manager or memorise it with a short story linking the words.

Why passphrases work

Security depends on how many guesses an attacker would need. Humans are poor at inventing random characters, so passwords like “P@ssw0rd1” follow predictable patterns. A passphrase chosen by a computer from a big list is unpredictable, and the words give your memory something to hold on to. Picture a vivid scene involving the words in order and you can usually recall it after a few uses.

This approach was popularised by the Diceware method, which uses physical dice to pick words from a list. This tool does the same job with your browser’s secure random generator and a shorter list of familiar words.

Reading the entropy figure

Entropy in bits is the base-2 logarithm of the number of equally likely possibilities. Each word is drawn from 512 options, so one word is 9 bits and five words are 45 bits. Every extra bit doubles the guessing work for an attacker who knows how the passphrase was made.

The figure assumes the attacker knows this exact word list and approach, which is the safe assumption. Whether 45, 60 or 90 bits is enough depends on the account, and on whether the service limits login attempts. A website that locks you out after a few tries needs far less than a stolen encrypted file that can be attacked offline at enormous speed.

Good habits

• Use one passphrase per important account, never reuse it.
• Keep a long passphrase for your password manager and let it create random passwords elsewhere.
• Do not choose between generated results until you like the words; rerolling many times does not weaken it, but altering words by hand does.
• Turn on two-factor authentication where possible.
• Never share a passphrase in chat or email.

Limits

Some sites cap password length or reject spaces. If that happens, change the separator or use fewer words and compensate with a number. A passphrase cannot protect an account if the device you type it on is infected with malware.

Why use this passphrase generator tool

• Curated 512-word list. Common, easy-to-spell words give exactly 9 bits of entropy per word.
• Honest entropy. The tool shows real bits of entropy, and explains that capitals and separators add almost nothing.
• Secure randomness. Words are selected with an unbiased draw from your browser’s cryptographic generator.
• Fully local. Nothing is sent or stored. The passphrase exists only on your screen.

Frequently asked questions

More free tools