Passphrase generator
Turn a handful of random words into a passphrase you can actually remember — and that a computer still can't guess. Words are chosen locally from a 3,500-word list using real cryptographic randomness.
Need a purely random string instead? Use the password generator.
How to build a passphrase
Pick how many words
Four words is the practical minimum; five or six gives you a passphrase that is both easy to recall and genuinely hard to crack. The entropy meter shows the payoff of each extra word.
Style it your way
Choose a separator, capitalize the words, or tack on a number to satisfy fussy password rules. Formatting is up to you — the strength comes from the random word choices.
Learn it, then use it
Read it aloud a few times and it sticks. Store it in a password manager as a backup, and reuse the method — never the phrase — for your next account.
Why a passphrase beats a password
Made for human memory
Your brain remembers vivid word pictures far better than a jumble of symbols. A phrase like amber-otter-canyon-drift is easy to picture and hard to forget, yet holds serious entropy.
Strength from length
Each random word here adds almost twelve bits of unpredictability. Five words already outrun a typical twelve-character random password — and you don't have to memorize gibberish.
Private by design
The word list ships inside this page. Nothing is fetched, nothing is sent, and your generated phrase never leaves the tab. Turn off your Wi-Fi and it still works.
The idea behind passphrases
The approach traces back to Diceware, a method that picks words at random from a numbered list. Because each word is chosen independently and uniformly, you can calculate the strength exactly: it is the number of words multiplied by the base-2 logarithm of the list size. There is no guesswork and no hidden weakness — the math is the whole point.
Why randomness matters
A passphrase is only as strong as the process that made it. Words you choose yourself — a pet's name, a favourite film, a birthday — are predictable and cluster around common choices, which attackers exploit. Letting a cryptographic generator do the picking removes that bias entirely, so every word carries its full share of entropy.
How many words do I need?
For everyday accounts, four to five random words is plenty. For a master password, an email account, or anything protecting other secrets, step up to six or seven. Each additional word roughly doubles the strength twelve times over, so the returns pile up fast while the phrase stays sayable.
Formatting tricks and their limits
Capitalizing words or adding a separator makes a phrase tidier and helps it pass strict validation rules, but a predictable pattern adds little real strength — an attacker will assume you title-cased it. Appending one random number genuinely helps a bit. The reliable lever is always the same: add another random word.
Frequently asked questions
Are passphrases actually secure?
Yes, when the words are chosen at random. A five-word passphrase from this tool carries around 59 bits of entropy, and six words over 70 — comparable to or better than a strong random password, while being far easier to remember. The strength comes from genuine randomness, not from the words themselves.
Where does the word list come from?
It is a curated list of roughly 3,500 common, easy-to-spell English words embedded directly in this page. Each word contributes about 11.8 bits of entropy. The list loads with the page, so no network request is ever made to fetch it.
Should I capitalize words or add numbers?
These options help you meet sites that demand mixed case or a digit. They add a little strength — appending a random number is worth a few bits — but the biggest gain always comes from adding another word. Do not rely on formatting to carry the security.
Can I use spaces in a passphrase?
Most modern sites accept spaces, and they make a phrase easier to read and type. If a site rejects them, switch the separator to a hyphen or dot, or remove it entirely — the underlying strength is unchanged.
Is it safe to generate my passphrase online?
Everything happens inside your browser using the Web Crypto API. The phrase is never transmitted or stored, and it disappears when you close the tab. You can disconnect from the internet before generating one for extra peace of mind.
How is the entropy calculated?
Entropy equals the word count times the base-2 logarithm of the list length, plus a small amount if you append a random number. Capitalization and separator choice are predictable, so they add no entropy and the meter does not count them.