Passphrase Generator

Four to eight words from a long list, because a sentence is easier to remember than a hash.

Your passphrase

Click it to copy · C

No phrase —

G to reroll

Alternatives

The first is not better than the last. Take the one whose picture you can hold in your head, and keep the shortlist short.

Entropy: —
Per word: —
Word list: —
Offline crack time: —

Words

How many 6

Each word multiplies the search space by 1,024, which is ten bits. Nothing else on this panel moves the figure as fast.

Shape

Between words

Capitalise each word Adds nothing to the count. The rule is public, so a guesser applies it too. Append two digits Worth 6.6 bits, roughly two thirds of a word. For forms that demand a number.

Good practice

One phrase per account that matters. Length does not survive reuse.
Say it out loud once before you save it. A phrase you stumble over is a phrase you will mistype at the worst moment.
Type it, don't paste it, on a machine you don't own. Anything running on that machine can read the clipboard.
Put it in a manager anyway. Being memorable is what stops you writing it on a note.

The word list is public and it ships with this page. Anyone attacking a phrase drawn here starts from 1,024 words per position, not from the 100,000 a dictionary would give them. That is not a flaw in the arithmetic: ten bits is ten bits whether the list is secret or not. It is, however, the reason six words is the sensible target and four is a floor. A phrase you invent from proper nouns and song titles has a different search space, and usually a smaller one.

Ten bits a word, and why the list is that size

A passphrase is only as strong as the list it was drawn from, and the list behind this page holds 1,024 words. That is not an arbitrary round number — it is two to the tenth, which makes every word worth exactly ten bits, and makes a phrase of six words exactly sixty. No correction factor, no estimate, no "roughly". Choose from 1,000 words instead and each word is worth 9.97 bits, so the arithmetic needs a decimal point and buys nothing for it.

The size also settles the drawing. With 1,024 words, the generator can take ten random bits and use them to index the list directly — every word reachable, every word equally likely, no value discarded. A list that is not a power of two forces either a rejection loop or a small bias, and the bias is exactly the kind of defect that never shows up in the output. The word count is a design decision that removes a class of problem rather than one that needs working around.

The arithmetic an attacker actually does

Every added word multiplies the search space by 1,024 rather than adding to it. Four words is 1,024 to the fourth, about 1.1 × 10¹² phrases. Six words is 1,024 to the sixth, about 1.2 × 10¹⁸. At ten billion guesses a second, the rate a serious offline attack against a fast hash reaches:

4 words   2^40  ~ 1.1e12 phrases   ~ 110 seconds, worst case
      6 words   2^60  ~ 1.2e18 phrases   ~ 3.6 years, worst case
                                         ~ 1.8 years, on average

The average column is the honest one, because an attacker working through the space finds a phrase in the middle of it rather than at the end. Two years is still long enough that the attack moves elsewhere — to a reused phrase, a leaked reset link, a support desk. The point at which the phrase stops being the weak part of the system arrives somewhere around six or seven words, which is why the effort after that is better spent on the accounts rather than on the string.

These figures assume the words came from the list. A phrase assembled from memory is drawn from the words you happen to like, which is a set of a few hundred at most and much the same from one person to the next. Attackers order their dictionaries by how often a word gets picked, not alphabetically, so the phrases people invent are near the front. Six words chosen by a generator and six words chosen by you are not the same sixty bits, and only one of them is arithmetic.

Words you can say out loud

A mixed-alphabet password of the same strength runs to fifteen or sixteen characters, and it has to be read one character at a time because there is no structure to hold on to. That is the thing working memory is bad at. A phrase is remembered as a small number of chunks — six words rather than sixty letters — and the sentence can be reconstructed from the shape of it even when one word goes missing.

That matters most in the two places a password is hardest to enter: a phone keyboard, where the symbol row is a keypress away and shift is a separate tap, and a television or console sign-in screen, where every character costs a cursor move. A phrase is also the only kind of secret that survives being spoken to someone in the same room, which is how a great many passwords get shared in practice.

It does not make the phrase memorable by itself. Six random words rarely form a sentence, and the ones that do are not more common than the ones that do not. What makes it stick is repetition over a day or two, and the alternative — a string with no structure at all — is the one that ends up in a note. A secret you can recall without writing down is stronger than a longer secret on a piece of paper, whatever the bits say.

What the phrase does not cover

A strong phrase protects one account. Used in three places it protects all three only as well as the weakest site stores it, and the sites that lose databases are rarely the careful ones. The phrase is a good fit for the one account that has to be typed frequently and remembered — a password manager's master phrase, a full-disk encryption key, a login you cannot put in a vault because the vault is behind it. Everything else wants its own string, and the Password Generator makes those, in whatever length the form will accept.

The word list is drawn from the page's own files, so the phrase does not depend on anything that has to be fetched, and the same phrase can be produced again after the page has loaded with the network gone. That is worth a moment's thought when deciding where to draw the phrase that guards everything else.

Reference

How long a passphrase needs to be

Words	Entropy	What it resists	Verdict
3 words	~38.8 bits	A login form that limits how often you can guess	Online-attack territory. Nothing holds once a database leaks.
4 words	~51.7 bits	A patient attacker working a live login form	The old Diceware recommendation. That is the floor now, not the target.
5 words	~64.6 bits	An offline attack on a stolen hash, by one good machine	A sensible minimum for an account that matters.
6 words	~77.5 bits	An offline attack on a stolen hash, by a rack of machines	Where most people should be for anything that matters.
7 words	~90.4 bits	An offline attack run on everything a budget can rent	Outlasts the value of the data behind the hash.
8 words	~103.2 bits	The same attack, running on hardware that keeps improving	Past the point where the passphrase is the weak part.
12 random characters	~78.7 bits	What six words resists, from a different alphabet	Same strength by a different route. Harder to say aloud, easier to paste into a strict form.

The entropy figures assume the standard 7,776-word list, which works out at 12.9 bits for every word added, and they are rounded to one decimal. The list behind this page's own readout is shorter than that, so a phrase drawn here scores below the matching row — the shape of the table is what carries over, not the decimals.

Bits count the phrases an attacker has to work through, and the column climbs because every added word multiplies that count by 7,776 rather than adding to it. Complicating a single word buys much less: a capital, a digit, a symbol in the middle each multiply the count by something in the tens, while one more word multiplies it by thousands. If you make one decision about a passphrase, make it the number of words.

The arithmetic rests on an assumption the table cannot show. The words have to come from a source nobody can predict. A phrase assembled from memory is not drawn from 7,776 words; it is drawn from the words you happen to like. That set is small, and much the same from one person to the next. Attackers order their lists by how often a word gets picked, not alphabetically. The figure above describes a generator, not a person.

Length also beats cleverness. P@ssw0rd! looks scrambled and is worth less than four random words, because those substitutions are the first thing a cracking tool's rules try: the @ for a, the 0 for o, the 1 for i, and the exclamation mark appended to everything. The rules exist because people reach for the same handful of tricks.

Questions

Passphrases, answered plainly

Is a passphrase better than a password?

For anything you have to type yourself, usually yes. Sixty bits is roughly 30 characters of ordinary words, and roughly 15 characters of a mixed alphabet — which is a string like k7#Rv!pLz9wQm4x, memorable to nobody, so it ends up in a note. A passphrase is no stronger per character. It is stronger per unit of effort, and effort is what decides whether a password gets reused.

Why does capitalising every word add no entropy?

Because a guessing program knows the rule. Entropy counts the strings you could have produced, and if the rule is "capitalise the first letter of each word", then every phrase maps to exactly one capitalised version of itself. The rule does not widen the space, it relabels it. A capital you chose yourself, in an unpredictable place, is a different matter.

My login form demands a digit and a symbol

The digit is what the number switch is for: two digits drawn from 100, worth 6.6 bits. A symbol is not something this tool offers, and the separator is the only punctuation it adds. Type one in yourself if the form insists, but do not overrate it — the attacker's uncertainty is only about which symbol, and how many there are to choose from is a short list.

Should I take one of the alternatives?

Choosing from four costs about two bits, the log2 of four, and choosing from twenty costs more than four. That is a real deduction rather than a rounding error, and it buys a phrase you will remember without writing down. Keep the list short, and take the first one that sticks instead of hunting for the best of the bunch.

How many words is enough?

Six is the sensible target: 60 bits, and roughly two years of offline guessing at ten billion a second. Four words is 40 bits, under a minute at that rate, so treat it as a floor rather than a target. Eight words is 80 bits and roughly two million years; past that you are optimising the part of the system that was never the weak one.

Does any of this leave the page?

The list is a JavaScript array inside the page's own files, and there is no server side for a phrase to travel to. Disconnect from the network after the page loads and keep drawing: the output is the same quality, because nothing in the draw depends on anything outside the tab.

What if the site rejects the spaces?

Join the words with hyphens, and set that with the separator control before the phrase is drawn rather than editing the output by hand. Of the two fixes it is the better one: a hyphen costs a fraction of a bit at most, since an attacker no longer has to guess which separator you used, and it costs nothing else. Capitalising each word also survives a form that hates spaces, and it is free, because the capital was never counted in the first place. What you should not do is invent a separator of your own and count it as worth a word.

Should I use a different passphrase for each site?

Yes. Reuse is the mechanism that turns one breach into a dozen logins, and the sites that spill are rarely the careful ones. Anything that holds your phrase in a form it can read back leaves it sitting in a database with everything else, and the dump gets tried against every other login you own. The only phrase that is safe to reuse is one that no service has ever held in a readable form, and no website qualifies. Put the accounts that matter in a manager and give each one a phrase of its own.

Which word list does this use?

A 1,024-word list of ordinary English words, which is ten bits a word and the reason every figure this page prints is a round number. It is shorter than the 7,776-word list Diceware uses, which is what the table above assumes at 12.9 bits a word, so a six-word phrase drawn here is 60 bits rather than 77.5, and 60 is the figure to plan around. The size of the file matters less than whether you are drawing from all of it. A phrase you assemble yourself comes from the thousand words you use every day, whatever list the generator holds.