Memorable Passphrase Generator (Diceware-style)
Generate a memorable, easy-to-read-aloud passphrase by randomly combining common words. Choose the word count, separator, capitalization, and a trailing number — everything runs entirely in your browser.
About the Diceware passphrase method
Diceware is a method for creating memorable passwords by using dice (or another random source) to pick several words from a word list and concatenating them. The result is far easier for humans to remember than a random string of letters and symbols, and its resistance to brute-force attacks (entropy) grows linearly as you add more words.
What Is Passphrase Generation?
A passphrase is a password built by stringing together several ordinary words instead of a short string peppered with symbols. To a person it is easy to remember as a sequence of words, and yet adding words raises its resistance to brute force linearly. This tool generates a passphrase on the spot once you set the number of words, the separator, capitalisation and whether to append digits.
Generation uses cryptographically secure randomness and everything happens inside your browser. Nothing is sent to a server or stored, so copy the string shown there and then. Reloading the page produces a different combination. The estimated strength shown alongside is a guide figure derived from the size of the word list and the number of words.
How to Create a Passphrase
- Decide the number of words Six or more is recommended. This tool's word list has 853 words, so each word adds about 9.7 bits; six words give about 58 bits, which beats a random 8-character password of letters, digits and symbols (about 52 bits).
- Choose the separator A hyphen is easy to read aloud, which helps when you have to pass it on verbally. For services that do not allow spaces, pick another symbol.
- Set capitalisation and appended digits These adjust the result for services that require a capital letter or a digit. You meet the requirement while keeping it memorable.
- Generate and copy You can regenerate until a combination you like appears. Once settled, copy it there and then and register it wherever you keep passwords.
Tips for getting more out of it
- We recommend at least 6 words. Four words (about 39 bits) are only about as strong as a random 6-character password of letters, digits and symbols.
- For things you need to read aloud or write down, such as a Wi-Fi password, a hyphen separator is easier to read and reduces typing mistakes.
- "Append a 2-digit number" is meant for services that require at least one digit. Digits are not symbols, so if a service requires a symbol, choose a symbol such as a hyphen or a period as the separator.
- The generated passphrase is only displayed, never saved. Reloading the page produces a new combination, so copy it immediately if you plan to use it.
When a Passphrase Comes in Handy
Setting a Wi-Fi password
Because you often have to read it out to visitors, a run of words is overwhelmingly easier to convey than a string of symbols. Hyphen separation suits reading aloud.
The master password for a password manager
This is the one password you genuinely have to remember yourself. A passphrase gives you the length while staying memorable.
A passphrase for an encrypted file
As the secret for a ZIP or a disk encryption, you can choose a form that is easy to pass on and hard to mistype.
A temporary shared password
Well suited to something shared within a team for a short period. Pasted into a chat, it is far less likely to be misread.
Passphrase Terms Explained
- Passphrase
- A password made by joining several words. It makes length easy to achieve and is straightforward to remember and to say aloud.
- Diceware
- A method that picks words from a list using dice or another source of randomness. This idea is the foundation of passphrase generation.
- Entropy
- An indicator that expresses how hard something is to guess, measured in bits. Each additional bit doubles the number of attempts a brute-force search requires.
- Brute-Force Attack
- An attack that tries every conceivable combination in turn. The length of a passphrase translates directly into resistance.
- Dictionary Attack
- An attack that tries commonly used words and passwords leaked in the past. Choosing words at random is what counters it.
- Web Crypto API
- The cryptographic facility built into browsers. It is what this tool uses to generate randomness that is hard to predict.
FAQ
Side Note — How "correct horse battery staple" changed the conversation
Diceware itself was devised by Arnold Reinhold in 1995, but it became widely known thanks to the webcomic xkcd, whose 936th strip (2011) compared a complex-looking but hard-to-remember password like "Tr0ub4dor&3" with a passphrase made of four plain words, "correct horse battery staple." The comic showed that the latter is actually harder to brute-force despite being far easier to memorize.
This apparent paradox comes down to information-theoretic entropy. Rather than widening the character set per position, picking several words from a large list accumulates more bits of randomness per selection. A list of 853 words yields roughly 9.7 bits per word, so four words give about 38.9 bits — about the same as 6 random characters mixing letters, digits and symbols (about 39.3 bits), and short of 8 such characters (about 52.4 bits). If you want more strength than an 8-character password of that kind, choose 6 words (about 58.4 bits) or more.
There are practical trade-offs, though. Longer passphrases are more prone to typos, and reusing the same passphrase across services means a single leak exposes every account. Note that the strength above is calculated assuming the attacker already knows the word list, so a known word list does not weaken it (the Diceware word lists are public, too). For your most sensitive accounts, treat a generated passphrase as a memorable master password for a password manager rather than reusing it everywhere.