Passphrase generator

Why random words beat clever passwords

The passwords people invent follow patterns: a name, a year, a capital letter at the front, an exclamation mark at the end. Attackers know every one of those habits and test them first, so a password that feels clever to you is usually routine to cracking software. A passphrase takes the opposite approach. It strings together words chosen completely at random, so there is no pattern to exploit, and because words are easy for humans to hold in memory you can make the whole thing long without writing it on a sticky note.

That trade is the whole trick. "correct-horse-battery-staple" style passphrases became famous for a reason: length is the biggest lever in password strength, and passphrases make length cheap. Typing four short words on a phone keyboard is also far less painful than picking symbols out of a shift menu. For sites that demand symbols and digits anyway, use our password generator instead, or add a digit to the end of a passphrase.

How the maths adds up

Strength is measured in bits of entropy: how many guesses an attacker would need on average. This tool picks each word independently from a list of 250, so every word multiplies the search space by 250, adding just under 8 bits. Crucially, the calculation assumes the attacker has the full word list and knows exactly how the passphrase was made. The randomness is the only secret, and it is enough.

Getting the most from a passphrase

• Add a word, not a twist. Swapping o for 0 or capitalising a letter adds almost nothing, because attackers test those variations automatically. One extra random word multiplies their work by 250.
• Use it once. Like any password, a passphrase reused across sites is only as safe as the least secure site on the list. Generate a fresh one for each account that matters.
• Let the generator choose. If you swap out a word you dislike, or pick your favourite from several runs, you leak human predictability back in. Take the first result.
• The separator is cosmetic. Hyphen, space or dot makes no real difference to strength. Pick whichever the site accepts and your thumbs prefer.

Serious systems sometimes use bigger lists: the well-known diceware list has 7,776 words, worth about 12.9 bits each. This tool deliberately uses 250 short, common words so every one is easy to spell and type; you get the same security back by adding a word or two.

Made on your device, never sent anywhere

The words are chosen by your browser's cryptographic random number generator, the same machinery your device uses to create encryption keys. The passphrase on screen has never travelled over the internet, is not logged or stored, and disappears when you leave the page. Where you save it matters too: a password manager is the right home for it, ideally guarded by a long passphrase of its own.

Frequently asked questions

Related tools