Passphrase Generator
Generate strong yet memorable passphrases from random words — the diceware approach. Pick the number of words, separator and capitalisation; entropy is shown live.
~47 bits of entropy from a 256-word list.
About this tool
A passphrase generator builds a password from several randomly chosen words rather than a jumble of symbols — for example maple-river-stone-clock. This "diceware" method, popularised by security researchers, produces passwords that are both easy for a human to remember and extremely hard for a computer to guess, because the strength comes from the random selection, not obscurity.
Why word-based passphrases work
Each word is picked at random from a fixed list using your browser's cryptographic random source. With a 256-word list, every word adds 8 bits of entropy, so a four-word passphrase has 32 bits and a six-word one has 48 — and because the words are random, no dictionary or "leet-speak" attack helps. Longer passphrases quickly become uncrackable while remaining typeable.
Tips
- Use at least five words for important accounts.
- Add a separator (hyphen or space) so words are distinct, and optionally a number or capital for sites that demand them.
- Never reuse a passphrase across sites — generate a fresh one each time and store it in a password manager.
Frequently asked questions
A passphrase is a password made of several words, such as 'maple-river-stone-clock'. When the words are chosen randomly, it is both easy to remember and very strong — the famous 'correct horse battery staple' idea.
A random multi-word passphrase of sufficient length is both stronger and easier to remember than a typical short password. Strength comes from random selection and length, so five or more random words is very hard to crack.
Four words is a reasonable minimum; five or six is recommended for important accounts. Each word from the 256-word list adds 8 bits of entropy, so six words gives 48 bits before any added numbers or capitals.
Yes. Words are selected in your browser using a cryptographically secure random source, and nothing is sent over the network or stored.