Passphrase generator
EFF wordlist, 7,776 words. Made on your device.
A few random words make a password you can actually remember and type, and it is still very hard to guess.
Why random words work
Each word is picked at random from 7,776 possibilities, which adds 12.9 bits of entropy per word. Five words give about 64.6 bits, six give 77.5, and seven give 90.5. The strength comes from the random choice, not from the words being unusual, so an attacker who knows the exact list still has to search every combination.
What does not work is choosing the words yourself. People pick related words, song lyrics and quotes, and cracking tools try those first. Let the generator choose.
| Words | Entropy (bits) | Offline, 10 billion guesses/s |
|---|---|---|
| 4 | 51.7 | 2 days |
| 5 | 64.6 | 45 years |
| 6 | 77.5 | 350,270 years |
| 7 | 90.5 | 3 billion years |
| 8 | 103.4 | 21 trillion years |
For the passphrase that unlocks a password manager, use at least six words. NIST SP 800-63B-4 asks sites to accept at least 64 characters and to allow spaces, which makes passphrases practical almost everywhere.
The word list
Words come from the EFF long wordlist, published by the Electronic Frontier Foundation for dice-generated passphrases. It was built to avoid words that are hard to spell, offensive or easy to confuse, and every word is between 3 and 9 letters. Here, a browser random number replaces the five dice rolls the list was designed for; the result is the same uniform choice.
Questions
Is a passphrase better than a random password?
For anything you type or remember, yes. Six random words are as hard to guess as a 12 character random password with every character type, and far easier to type on a phone. For passwords kept in a password manager, a random string is shorter for the same strength.
Does capitalising or adding a number help?
Very little. Capitalising every word is a fixed rule, so it adds no entropy. Adding one digit in a random place adds about 5 bits. Both exist for sites that insist on them. Another word adds 12.9 bits.
Can I use spaces?
Many sites accept them, and NIST SP 800-63B-4 says they should. If a site rejects spaces, choose the hyphen or full stop separator.
What is diceware?
A method from 1995 where you roll five dice to pick each word from a numbered list. It is a way to get true randomness without a computer. This generator does the same selection with the Web Crypto API.
Sources
- EFF Dice-Generated Passphrases and the long wordlist, Electronic Frontier Foundation. Checked 18 October 2026.
- SP 800-63B-4, section 3.1.1.2: Password Verifiers, National Institute of Standards and Technology. Checked 18 October 2026.
- Crypto: getRandomValues() method, MDN Web Docs. Checked 18 October 2026.