Secure Passphrase Generator

Generate passphrases from a curated word list using your browser's cryptographic randomness, with the entropy of each choice shown as you change it.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

Words

Separator

How many to generate

Capitalise each word (adds no entropy) Append two digits (adds 6.6 bits)

Why the entropy figure is the actual product

Joining random words together is easy. What makes a passphrase generator worth trusting is being able to state precisely how much guessing the result resists - and having that statement be true.

It is true here for three specific reasons. The list has exactly 7776 words, so each one contributes exactly log2(7776) = 12.925 bits. There are no duplicates, so no word is likelier than another. And the selection uses rejection sampling rather than a modulo, because a modulo over a 32-bit random value biases very slightly towards the start of the list - not enough to matter practically, but enough to make the printed number a small lie.

Six words is 77.5 bits. That figure assumes the attacker knows the entire scheme: the wordlist, the count, the separator, everything except the words chosen. Security that depends on the attacker not knowing the method is not security.

Capitalising adds nothing, and this page says so

Many generators offer capitalisation and quietly count it towards the strength figure. It is a fixed rule applied to every word rather than a random choice, so an attacker who knows the scheme - and they do - gains nothing. The option exists here because some password fields still demand a capital letter, and the entropy figure above deliberately does not count it.

Appending two digits genuinely does add entropy, because the digits are random: 6.6 bits, which is what gets counted. Worth far less than adding one more word.

The wordlist

The EFF long wordlist, published in 2016 and used here under CC BY 3.0 US. It was built for exactly this job and its properties are what make the arithmetic clean: 7776 entries because that is 6⁵ and so each word is five dice rolls; no word is a prefix of another, so a passphrase is unambiguous even typed without separators; nothing is easily confused when spoken or typed; and profanity and distinctive spellings are excluded.

You can generate the same passphrases with five dice and the published list, and get the same guarantees without trusting any software at all - including this page.

Generated here, and never transmitted

Every word comes from crypto.getRandomValues, the browser's cryptographic random source. Nothing is sent anywhere - which for a page whose entire output is credentials ought to go without saying, and does not.

Frequently asked questions

How many words do I actually need?

Six is the usual recommendation and gives 77.5 bits, beyond offline attack with any storage. Four is 51.7 bits, which is fine behind a rate-limited login but not against a stolen database. If it is protecting a password manager, use seven or eight.

Is a passphrase really better than a random string?

Not bit for bit - a 16-character random string beats six words. It is better in practice because you can remember it, and a password you can remember does not get written on a sticky note or reused across sites. For anything you have to type from memory, the passphrase wins.

Does the separator matter?

Not for entropy - it is fixed, so it adds nothing. It matters for typing and for password fields that reject spaces. Because no word in this list is a prefix of another, even "nothing" stays unambiguous.

Should I add my own words?

No. Any word you choose yourself is a word an attacker can guess more cheaply than one in 7776, and it breaks the arithmetic - the stated entropy would no longer be true.

Can I trust a generator I found on the internet?

Reasonably asked. Check that it uses crypto.getRandomValues rather than Math.random - the second is predictable and produces identical-looking output - and that no request fires when you generate. For the highest-value secrets, dice and the published list need no trust at all.

References

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.