Free Passphrase Generator

A passphrase is a password made of several random words, such as “abacus tinsel ripple canopy”. Its strength comes from the number of words and the size of the word list, not from clever spelling, so a long phrase can be both strong and easy to remember. Because the words are chosen at random, there is no pattern for an attacker to exploit.

With the 7,776-word EFF Large list each word adds 12.9 bits. That gives about 52 bits for 4 words, 65 for 5, 78 for 6 (the usual recommendation), 90 for 7 and 103 for 8. Use 6 words for most accounts and 7 or more for a password manager master password or disk encryption. With a 1,296-word short list each word adds 10.3 bits, so use one more word.

Each word is picked uniformly at random from a published word list using your browser’s cryptographic random number generator, with no modulo bias. The strength is exact: the number of words multiplied by log2 of the list size, plus the bits from any capitals, number, symbol or random separators you switch on. The calculation assumes an attacker knows the word list and your settings, which is the safe assumption.

EFF Large (7,776 words) gives the most strength per word and is the default. EFF Short 1 (1,296 short, common words) and EFF Short 2 (1,296 longer words whose first three letters are unique, which helps autocomplete and typing) give fewer bits per word, so add a word to compensate. All three lists were designed by the Electronic Frontier Foundation to avoid offensive, confusing and hard-to-type words, and are used under a Creative Commons Attribution 3.0 US licence.

Only when a site demands them. Each one adds just a few bits, shown in the page’s notes, while one more word adds about 13 bits and is easier to type. When a site requires them, capitalise every word and add a number or symbol, then add a word if you need more strength.

Every word in the EFF lists has a number you get by rolling dice: five rolls for the large list and four for the short lists. Switch on “Show dice numbers” to see the number of each generated word. If you do not want to trust any software, roll real dice, look the numbers up in the EFF list and build the phrase yourself.

A phrase you make up, such as a favourite quote or a line from a song, is far easier to guess than a random one, because people choose predictable words and orders. Use the random words, then use a short story or picture to remember them.

Say it aloud a few times, make a short story that links the words in order, and type it every day for the first week. It is fine to write it on paper kept in a safe place while you learn it. Use passphrases for the few secrets you must remember, such as a password manager or disk encryption, and let a password manager hold random passwords for everything else.

Yes. The words come from lists built into the page, so the page needs no network connection and no outside word service. It loads no outside scripts, its content security policy blocks outgoing network requests, and none of what you generate is saved in cookies or local storage (the page only remembers your chosen site language). The passphrase is cleared after 10 minutes without activity.

At the same strength they are equally secure. A 6-word passphrase of about 77 bits matches a random password of about 12 characters from the full keyboard. Passphrases are easier to type and remember, so they suit secrets you enter by hand. Random character passwords are shorter on the screen and suit passwords kept in a password manager.