Passphrase Generator
Generate memorable passphrases using random words
Passphrases are easier to remember but still very secure
Why use passphrases?
Passphrases are easier to remember than random characters while being just as secure. A 4-word passphrase can have more entropy than a 12-character random password.
How strong is a passphrase? The real numbers
The generator on this page draws from a list of 1,580 unique words for this language — every word adds about 10.6 bits of entropy. The table shows how long an attacker would need on average, assuming they already know both the wordlist and the number of words.
| Words | Combinations | Entropy (bits) | Online attack* | Offline attack** |
|---|---|---|---|---|
| 3 | 3.9 × 109 | 32 | 23 days | instantly |
| 4 | 6.2 × 1012 | 43 | 99 years | 3 seconds |
| 5 | 9.8 × 1015 | 53 | 156,010 years | 82 minutes |
| 6 | 1.6 × 1019 | 64 | 246M years | 90 days |
| 7 | 2.5 × 1022 | 74 | 389B years | 389 years |
| 8 | 3.9 × 1025 | 85 | 615T years | 615,351 years |
Rule of thumb: at least 5 words for web accounts, 7 or more for a password manager master password or file encryption.
* Attack against a web login, ~1,000 guesses per second. ** Attack on a leaked password hash, ~1 trillion (10¹²) guesses per second.
Frequently asked questions about passphrases
- What is a passphrase?
- A passphrase is a password built from several randomly chosen words — in the style of “correct horse battery staple”. The idea, known from Diceware, is that a few random words are far easier to remember than a string like Xk#9v!2p, while the number of possible combinations stays astronomically large. The words must be picked at random: a quote or a sentence you make up yourself is much weaker.
- How many words should a passphrase have?
- Each word from this page’s list adds about 10.6 bits of entropy: 4 words ≈ 43 bits, 6 words ≈ 64 bits, 8 words ≈ 85 bits. Rule of thumb: at least 5 words for web accounts, 7 or more for a password manager master password or file encryption.
- Is a passphrase more secure than a regular password?
- In practice, yes. Passwords people invent themselves typically hold only 20–30 bits of entropy — names, patterns and years are predictable. Six random words from this list hold about 64 bits, and the strength comes from genuine randomness rather than substitutions like P@ssw0rd, which cracking tools try first.
- The wordlist is public — isn’t that a problem?
- No. The table above already assumes the attacker has the wordlist and knows the word count. The security lies entirely in the number of combinations (Kerckhoffs’s principle: a system must stay secure even when everything but the key is known). What matters is that the words are picked truly at random — which happens locally in your browser using the Web Crypto API.