Memorable Password Generator
Create strong passwords that are easy to remember, made from random words, with a real entropy figure instead of a guess.
100% client-side · Cryptographically secure randomness · Nothing is stored or sent
Strength counts only the random choices (words, digits and symbol) and assumes an attacker knows exactly how the password was made. Capitalization and separators add none.
Why Random Words Beat Clever Tricks
Entropy is the number of random choices behind a password, counted in bits. Picking one word from a list of 7,776 gives log2(7776) ≈ 12.9 bits, and independent picks add up, so five words give about 65 bits and seven about 90. A typical human-made password such as a name with a number on the end has a small fraction of that, however complicated it looks.
This tool draws every word with the Web Crypto API and rejection sampling, so each of the 7,776 words is exactly equally likely. The list used is the EFF long wordlist, which is made of common, distinct and easy-to-spell words chosen for exactly this purpose.
Web Crypto Randomness
crypto.getRandomValues() with rejection sampling. Math.random() is never used
7,776-Word List
The EFF long wordlist, about 12.9 bits for every word
Honest Strength
Strength is real entropy, not a rating based on length
Fully Adjustable
Words, separator, capitals, digits and symbol, with results that update at once
No Silent Downgrade
If the Web Crypto API is missing, the tool says so and refuses to generate
Private by Design
Runs in your browser. Nothing is uploaded, stored or logged
Explore more free tools in our security tools collection, including our strong random password generator.
Word list: the EFF long wordlist for passphrases, © Electronic Frontier Foundation, licensed CC BY 3.0 US.
Frequently Asked Questions
1. What is a memorable password?
A memorable password, often called a passphrase, is built from several unrelated words instead of a short jumble of characters, for example Cactus-Tutu-Dried-Impale-Gleeful7!. Words are far easier for people to remember and type than random characters, and because every extra word multiplies the number of possibilities, a few random words can be just as hard to guess as a much shorter string of symbols.
2. How does this generator work?
It picks each word at random from a list of 7,776 words (the EFF long wordlist) using your browser's Web Crypto API, a cryptographically secure random number generator. A rejection-sampling step removes modulo bias, so every word is exactly equally likely, and Math.random() is never used. You choose how many words, the separator, capitalization, and whether to add digits and a symbol. If the Web Crypto API is unavailable, the tool turns itself off rather than using weaker randomness.
3. How strong is the password, and how is the strength measured?
Strength is measured in bits of entropy: the base-2 logarithm of the number of equally likely passwords the generator could have produced. Each word from a 7,776-word list adds about 12.9 bits, each added digit about 3.3 bits, and a symbol about 3.3 bits. So 4 words give about 52 bits, 5 words about 65 bits, 6 words about 78 bits and 7 words about 90 bits; for comparison, 12 random characters from the full keyboard give about 79 bits. The rating assumes an attacker knows exactly how the password was made and has to guess among all possibilities. Capitalization and separators are fixed choices, so they add no entropy.
4. How many words should I use?
Five words (about 65 bits, or about 71 with a digit and a symbol) is a solid default for ordinary accounts. Use six or seven for a password-manager master password, disk encryption or anything that must survive offline attacks on a stolen password hash. Three words is only a minimum for low-value accounts that also limit login attempts.
5. Why not choose the words myself?
People are predictable: we favor common words, song lyrics, names and famous quotes, and attackers' tools try exactly those. What makes a passphrase strong is that the words were chosen at random, so do not swap in words you like better. Substituting letters (such as a for @) adds very little protection because cracking tools try those swaps too. If a generated phrase is hard to picture, generate another instead of editing it.
6. How do I remember it?
Make up a short, vivid story or picture that connects the words in order, then type the password a few times over the next days. Most people only need to memorize one or two passwords: use a password manager for everything else and keep a strong memorized passphrase for the manager itself. Never reuse a passphrase across sites.
7. Do I need to add a number and a symbol?
Only if the website insists. A digit or symbol adds about 3.3 bits each, while one more word adds about 12.9 bits, so a longer phrase is a better way to gain strength than extra characters. Turn the options on when a site requires them, and note that some sites reject certain symbols or limit the length.
8. Is my password stored or sent anywhere?
No. Passwords are generated in your browser, the page's content security policy blocks outgoing network requests, and nothing is saved: there is no history and no local storage. The only thing the site remembers is your language choice for the menu. Copy the password straight into your password manager or the account you are protecting.