๐ Passphrase Generator
Estimated entropy: ~57 bits
Generate memorable yet secure passphrases by randomly combining words, in the style of Diceware. Customise the number of words, separator, capitalisation and a trailing number, and see the estimated entropy. Handy when you want a password that is easier to remember than a random string.
How to use
- Set the word count, separator, and other options.
- Press "Generate" to see a new passphrase.
- Press "Copy" to copy it to your clipboard.
How the calculation works
A passphrase is a long password made of randomly chosen words. This tool picks words from a list of 1,024 distinct English words using the browser's cryptographically secure random number generator. Since 1,024 = 2ยนโฐ, each word adds exactly 10 bits of entropy. A two-digit number at the end adds about 6.6 bits more (logโ100). Entropy = 10 ร words (+ 6.6 with the number) Because the list length is a power of two, taking a 32-bit random value modulo 1,024 picks every word with exactly equal probability. Capitalisation and separators help memorability but are not counted in the entropy, since an attacker is assumed to know your settings.
Worked example
Five words, "-" separator, capitalised, with a number Maple-Rocket-Tulip-Canal-Frost42 Entropy: 10 ร 5 + 6.6 โ 57 bits Six words without a number give 60 bits. For comparison, a random string of letters and digits (62 characters) needs about 10 characters for the same strength.
Things to be aware of
- For important accounts, use five or more words (50+ bits). For a password manager's master password, six or seven words are safer.
- Words you pick yourself tend to be common or related, which makes them easier to guess. Always use the randomly chosen words as they are.
- Passphrases are generated in your browser and never sent anywhere.
FAQ
Is a passphrase more secure than a random string?
With enough words, a passphrase can match or exceed the strength of a random string while being much easier to remember. More words means greater strength.
What does the entropy (bits) shown mean?
It's a measure of how hard the passphrase is to guess โ the higher the number, the more resistant it is to brute-force attacks.
Is the generated passphrase sent to a server?
No, everything is generated locally in your browser using a cryptographically secure random number generator โ nothing is sent anywhere.