Passphrase Generator
How to use
Generates memorable multi-word passphrases (like the "correct-horse-battery-staple" style) instead of random character strings, which are easier to remember and type while remaining hard to guess. Choose the word count, separator and casing options, then copy the result.
~39 bits of entropy
Configuration
Separator
- Creating a master password for a password manager that you'll need to type from memory
- Setting a passphrase for full-disk encryption or a hardware wallet
- Choosing a Wi-Fi password that guests can actually read and type correctly
- Picking a memorable but strong password for a shared family or team account
Why a sequence of ordinary words can be stronger than a dense one
A passphrase built from randomly chosen words gets its strength from the size of the word list and the number of words drawn, not from looking complicated. Each word drawn from a list of N words adds log2(N) bits. This generator draws from 250 short, common English words, so each word adds about 8 bits: four words give roughly 32 bits, six give 48 and eight give 64, and the strength meter shows the exact figure for your settings. The standard Diceware list has 7,776 words and adds about 12.9 bits per word, so it reaches the same strength in fewer words; a short, familiar list trades that for words that are easier to type on a phone, read aloud or remember.
The critical condition is that the words must be chosen randomly by the generator, not by you. Human-chosen word sequences cluster hard around phrases, song lyrics and semantically related groups, and attack tools model that clustering directly. "correct horse battery staple" is strong as a randomly generated example and worthless as a password, because it has been published millions of times. The entropy figure only holds if each word was drawn independently from the full list.
Length requirements shape the trade-off. Where a system accepts long inputs, a passphrase is the better choice for anything you must type by hand: a disk encryption key, a password manager's own master password, a machine you log into before a manager is available. Where a system caps length at ten or twelve characters, a passphrase cannot reach useful entropy and a dense random string is the right tool. Check the field's limit before deciding which to generate.
Free and private. Everything runs on your own device, with no account and no uploads.
Random character passwords are strong but hard to remember or type. This tool generates memorable multi-word passphrases in the "correct-horse-battery-staple" style instead.
From a built-in list of 250 short, common English words chosen to be easy to read and type. Each word is picked with the browser's cryptographic random number generator, so every word on the list is equally likely.
Add words: each one adds about 8 bits. Turning on the number adds about 6.6 bits more. Capital letters and the separator do not add strength here, because they are applied the same way to every word rather than chosen at random.
For an account protected by login limits, five or six words is reasonable. For anything an attacker could test offline, such as a password manager's master password, disk encryption or an encrypted archive, use eight words with the number turned on, which gives about 70 bits.
- 1
Set the word count
Choose how many words to include in the passphrase.
- 2
Pick separator and casing
Adjust how words are joined and capitalized.
- 3
Copy the passphrase
Grab the generated passphrase to use as your password.
- ·Use at least 5-6 words for anything security-critical, shorter passphrases are easier to brute-force than they feel.
- ·Adding a random number or symbol to one word meaningfully boosts strength without hurting memorability.
- ·Avoid picking a well-known quote or lyric instead of the randomly generated words, that defeats the entropy benefit.