Passphrase Generator

This passphrase generator builds passwords out of random words drawn from a 7,772 word list, so you get something like maple-cinder-harbor-velvet that is far easier to remember than a string of symbols. Pick 3 to 10 words, choose a separator, and watch the entropy figure update.

How to use this passphrase generator

1. Pick the word count, from 3 to 10. Four words is a workable floor for everyday accounts, and six or more is the safer pick for email, banking or a password manager itself.
2. Choose a separator: dash, space, dot or none. Dashes and dots pass almost every password field. Spaces work in most places now but still trip up a few older forms.
3. Decide on the extras. Capitalising each word makes the phrase easier to read back off a screen, and adding a number at the end helps with sites that demand a digit.
4. Choose how many passphrases to make in one batch, from 1 to 20, and read through them for one that sticks in your head.
5. Copy the one you like or download the batch as a text file, then store the winner in your password manager like any other password.

You can regenerate as often as you like. The draw is fresh every time, and a phrase you skip is gone for good, which is fine because the supply is close to endless.

How the word count drives passphrase strength

Each word is drawn at random from the same 7,772 word list, so each word adds about 12.9 bits of entropy. Four words gives about 51.7 bits. Five gives about 64.6 bits, and six gives about 77.6 bits, which is past what online guessing and most offline attacks can handle.

The shape of the growth is the part people miss. Each added word multiplies the combinations by 7,772, so a six word phrase is not half again as strong as a four word phrase, it is tens of millions of times harder to guess.

The word list comes from the EFF large wordlist, the list behind the Diceware method, with four hyphenated words left out so a dash separator never hides inside a word. The list is public, and that is fine: the strength sits in the random draw and the count, exactly as an attacker assumes when working through every combination.

The extras deserve a straight word. Capitalising the words and tacking on a number add very little strength, because attackers try those shapes early and the readout here does not credit them. They exist for sites with picky rules and for human eyes, not for the maths.

Details and limits of this passphrase generator

The words are only strong because they are drawn at random. If you swap in your dog’s name, your street and your favourite team, you have rebuilt the kind of password attackers guess first. Take the draw as it comes, or redraw until a random phrase happens to please you.

Never build a passphrase from a famous quote, a song lyric or a line from a film, and this tool will not either. Attackers carry lists of exactly those, and a quoted phrase falls almost at once no matter how long it is.

Practical limits exist too. Some sites cap password length, and a seven word phrase can run past those caps. Some reject spaces, which the separator setting handles. And while a phrase is easier to remember than random characters, typing it on a phone is slower, which is a fair trade for an account you log into rarely.

Everything runs in your browser. Nothing is sent anywhere, nothing is stored, and the phrases you do not pick are never written down anywhere.