Generate a passphrase

Your passphrase

5
Strength
65 bits
Comparable to
a fully random password of 10 characters from letters, digits and punctuation.

Words are picked with your browser's cryptographic random number generator. Nothing is sent, stored or logged. If you want to be sure, disconnect from the internet: the page keeps working.

Why words

Length beats odd characters

A password is strong because of the number of possibilities an attacker has to try, not because of how complicated it looks. Each word from this list of 7,776 words adds almost 13 bits. Five words give you over 64 bits; six give over 77.

It does not matter that the words come from a public list. The strength lies in the randomness of the choice, not in keeping the list secret. This is the idea behind xkcd 936 and the EFF's Diceware method.

If you pick words you happen to like, the phrase is far weaker than the maths suggests. Let the generator choose and take the first phrase you can remember.

How to use it well

  • Use a password manager and let it create a unique password for every site. Use a passphrase as the master password of that manager and for your computer.
  • Turn on two-factor authentication wherever you can; a strong password alone is not enough.
  • Never reuse a phrase. One leak and it is known everywhere.
  • Change a password when it has leaked, not every three months out of habit.

FAQ

Frequently asked questions

About how the generator works and what the numbers mean.

No. The word list and the code live in your browser, and the choice happens there too. No request goes to our server when you click "New passphrase". You can verify that in your browser's network panel.

For a password manager or your computer, five or six words are a good choice. For something that can be attacked offline, such as an encrypted disk or a key file, take seven or more. The "bits" figure on the page works it out for each setting.

Every bit doubles the number of possibilities. 64 bits means roughly 18 quintillion possible phrases. That number follows directly from the list size and the word count; it says nothing about how fast a specific attacker can guess, because that depends on how the service stores your password.

Hardly. The capital always sits on the first letter and adds no randomness. The digit adds a little over three bits. Both options exist mainly for sites that require such a character. An extra word gives you more.

The EFF Large Wordlist: 7,776 English words chosen by the Electronic Frontier Foundation because they are easy to remember and type and do not resemble each other. The list is public and lives at eff.org/dice.

Word list: EFF Large Wordlist by the Electronic Frontier Foundation, licensed CC BY 3.0 US. Idea: xkcd 936.