What wordlist does this use?

This tool uses a 7,776-word EFF long wordlist, the same wordlist used in Diceware — the gold standard for passphrase generation.

How much entropy does each word add?

Each word randomly chosen from a 7,776-word list adds log2(7776) ≈ 12.9 bits of entropy. Four words therefore give roughly 51 bits, five words roughly 65 bits, and six words roughly 77 bits — each extra word roughly doubles the difficulty of a brute-force attack.

Should I capitalise words or add a number?

These options matter little to security but help satisfy sites that demand an uppercase letter and a digit. The security comes from the random word choices and their count, not from decoration. If you add characters, keep them in a consistent place so they are easy to remember.

Can I use a passphrase as a master password?

Yes, a six-word or longer passphrase is an excellent master password for a password manager. It is far harder to guess than a short random string and much easier to type on a mobile device. Keep it offline, memorise it, and never reuse it anywhere else.

🔒 Free Security Tool

Passphrase Generator

Generate strong, memorable passphrases from random words. Easier to remember than random characters — and often more secure. Nothing leaves your browser.

— bits entropy

Number of words More words = more secure

Separator Between words

Capitalise first letter Each word

Add a number Appended to passphrase

🧠 Easy to Remember

A 5-word passphrase is far easier to remember than Xk9#mP2@qR, yet significantly more secure against brute-force attacks.

🎲 Diceware-Style

Uses the EFF long wordlist — the gold standard for passphrase generation, designed for maximum randomness and memorability.

🔒 100% Private

All generation happens in your browser using crypto.getRandomValues(). Your passphrase never touches a server.

Frequently Asked Questions

What is a passphrase?

A passphrase is a password made of multiple random words rather than random characters. Introduced by security researcher Bruce Schneier and popularised by the XKCD comic "correct horse battery staple", passphrases are both easier to remember and often more secure than short random character strings.

How many words do I need?

4 words provides ~52 bits of entropy — adequate for most accounts. 5 words gives ~65 bits — recommended for important accounts. 6+ words (~77 bits) is suitable for master passwords and highly sensitive accounts. As a rule: more words is always better.

Are passphrases more secure than random passwords?

A 6-word passphrase from a 7,776-word list has 77 bits of entropy. A random 12-character password with upper, lower, digits and symbols has about 72 bits. So yes — a long passphrase can be more secure than a short random password, and is far easier to type and remember.

Should I still use 2FA with a passphrase?

Absolutely. A strong passphrase protects you against password-guessing attacks, but 2FA protects you even if your passphrase is somehow compromised through phishing or a data breach. Use both together for best protection.

How to use the Passphrase Generator

Pick your word count. The dropdown offers 3 to 8 words. Five words (the default) is a good balance for everyday accounts; six or more is right for master passwords and financial services. Do not go below four.
Choose a separator. Hyphens, dots, and underscores create natural word boundaries, which makes the phrase easier to type. A plain space works too, but some systems strip spaces, so a symbol is often safer.
Set the display options. Capitalising the first letter of each word and appending a two-digit number are enabled by default: they cost almost no entropy and help you pass sites that demand mixed case and digits.
Click Generate until you like the phrase. Every click produces a new combination drawn from the 7,776-word list using crypto.getRandomValues(), the browser's cryptographically secure random source.
Check the entropy badge. The tool shows your phrase's entropy in bits. Treat anything below 50 bits as too weak for anything important, and remember the estimate assumes the phrase was generated randomly — a hand-picked sequence of words is far weaker than the same number of random ones.
Copy and store it properly. Use the Copy button and save the phrase in a password manager if you cannot memorise it. Never type it into email, chat, or any website other than the one it protects.

Why random words beat random characters

Password strength comes from entropy — the number of possibilities an attacker must search through — and entropy comes from randomness, not from visual complexity. Each word in an EFF-style wordlist contributes about 12.9 bits of entropy, because each word is one of 7,776 equally likely choices. Four words give roughly 51 bits, and every additional word multiplies the search space by 7,776, adding another 12.9 bits. Contrast that with a typical human-made password like P@ssw0rd!: it may look complicated, but a cracking tool that tries common leetspeak mutations discovers it almost instantly.

The same entropy can be delivered by random characters, of course — but character strings are miserable to memorise, so people reuse them or write them down. That is where passphrases win: a five-word phrase with roughly 65 bits of entropy is memorisable after a few uses, while a random 12-character string with the same ballpark strength is not. The practical result is that passphrases are the option people actually keep unique and keep secret, which is what defeats credential-stuffing and brute-force attacks in the real world.

Two pitfalls to avoid. First, never invent your own passphrase from song lyrics or quotes — recognisable phrases can be guessed using public databases of common phrases, no matter how long they are. Second, adding a number at the end does not materially increase security if the words themselves are predictable; random generation is what matters. Generate the phrase here, memorise it, enable 2FA on the account, and you have done more for your security than any “complexity” rule ever will.