Passphrase Generator
Generate passwords made of random words that are easy to remember.
Your data is never sent to any server.
The passphrase generator creates keys made of random words, along the lines of “bridge-salmon-candle-tiger”. They are long, easy to remember and easy to type, and with enough words they hold out as well as a string of symbols. Nothing you generate leaves your device.
Why they work
Intuition says “Tr0ub4dor&3” looks safer than “bridge salmon candle tiger”, and the opposite is true. Strength comes from the number of possible combinations, not from appearance:
| Key | Entropy | Time to crack |
|---|---|---|
| ”Tr0ub4dor&3”, a word with substitutions | ~28 bits | an instant |
| 6 random words | 60 bits | about two months |
| 8 random words | 80 bits | about 190,000 years |
The times assume the worst case: an attacker with a powerful graphics card and a stolen database where the passwords were poorly protected. The first key takes effort to remember and falls at once; the others are remembered as a mental image.
The one thing that ruins a passphrase
Picking the words yourself. Someone “thinking of four random words” ends up choosing things related to each other, to their own life or to whatever is in front of them, and that cuts the real combinations by several orders of magnitude. The randomness has to come from the generator, not from your head.
Where they shine
In passwords you have to type from memory: your password manager’s master key, your computer’s disk encryption, the home WiFi password you end up reading out to guests. Also on devices where typing symbols is painful, such as a TV or a games console.
How to use Passphrase Generator
- 1
Choose how many words
Each word comes from a list of 1024 and adds 10 bits. Six words are the sensible minimum for an account; eight for a password manager's master key or disk encryption.
- 2
Choose the separator
Hyphen, dot, underscore or space. It makes no difference to security, so pick whichever is easiest for you to type.
- 3
Add capitals or a digit if required
Some services demand an uppercase letter or a number. Those options are there to satisfy the requirement, not because they make the phrase stronger.
- 4
Generate and copy
Regenerate until you get a combination that is easy for you to picture, then save it. Regenerating costs no security: every combination is equally likely.
Frequently asked questions
Is a password made of words actually secure?
Yes, as long as the words are chosen at random and there are enough of them. What makes it strong is not looking complicated but the number of possible combinations: with this list, every word multiplies that number by 1024.
How many words do I need?
At least six for ordinary accounts, which gives 60 bits. Eight for whatever protects everything else, such as your password manager's master key or disk encryption, which reaches 80 bits. With four words the tool will show you that such a key would fall in seconds if someone stole a poorly protected database.
Why does the list have only 1024 words?
So that they are common, short words that are easy to remember and type. Other lists, such as Diceware's, have 7776 words and add almost 13 bits each, but include many unusual ones. Here one or two extra words make up the difference.
Can I choose the words myself?
Not a good idea. People pick words related to each other and to their own lives, which cuts the real number of combinations dramatically. A passphrase's security depends on the choice being genuinely random.
Isn't it weaker than a password of symbols?
No, not with enough words. It takes longer to type but is far easier to remember, and at equal entropy it holds out exactly as well. The fair comparison is between entropies, not between how odd each one looks.
What is Diceware?
A classic method for building passphrases by rolling physical dice against a numbered word list. This tool does the same thing with the browser's cryptographic generator, no dice required.
Is it suitable as a password manager master key?
That is its very best use. The master key is the one password you have to hold in your head and type often, and there a multi-word phrase beats any string of symbols.