Memorable Passphrase Generator (Diceware-style)
Generate a memorable, easy-to-read-aloud passphrase by randomly combining common words. Choose the word count, separator, capitalization, and a trailing number — everything runs entirely in your browser.
About the Diceware passphrase method
Diceware is a method for creating memorable passwords by using dice (or another random source) to pick several words from a word list and concatenating them. The result is far easier for humans to remember than a random string of letters and symbols, and its resistance to brute-force attacks (entropy) grows linearly as you add more words.
What Is Passphrase Generation?
A passphrase is a password built by stringing together several ordinary words instead of a short string peppered with symbols. To a person it is easy to remember as a sequence of words, and yet adding words raises its resistance to brute force linearly. This tool generates a passphrase on the spot once you set the number of words, the separator, capitalisation and whether to append digits.
Generation uses cryptographically secure randomness and everything happens inside your browser. Nothing is sent to a server or stored, so copy the string shown there and then. Reloading the page produces a different combination. The estimated strength shown alongside is a guide figure derived from the size of the word list and the number of words.
How to Create a Passphrase
- Decide the number of words Four or more is recommended. With three or fewer the estimated strength falls short and it will not stand up to purpose-built cracking tools.
- Choose the separator A hyphen is easy to read aloud, which helps when you have to pass it on verbally. For services that do not allow spaces, pick another symbol.
- Set capitalisation and appended digits These adjust the result for services that require a capital letter or a digit. You meet the requirement while keeping it memorable.
- Generate and copy You can regenerate until a combination you like appears. Once settled, copy it there and then and register it wherever you keep passwords.
Tips for getting more out of it
- We recommend at least 4 words. With 3 or fewer, the estimated entropy is often too low to resist dedicated cracking tools.
- For things you need to read aloud or write down, such as a Wi-Fi password, a hyphen separator is easier to read and reduces typing mistakes.
- If a service requires a symbol, enabling "Append a 2-digit number" can help satisfy complexity requirements without adding punctuation.
- The generated passphrase is only displayed, never saved. Reloading the page produces a new combination, so copy it immediately if you plan to use it.
When a Passphrase Comes in Handy
Setting a Wi-Fi password
Because you often have to read it out to visitors, a run of words is overwhelmingly easier to convey than a string of symbols. Hyphen separation suits reading aloud.
The master password for a password manager
This is the one password you genuinely have to remember yourself. A passphrase gives you the length while staying memorable.
A passphrase for an encrypted file
As the secret for a ZIP or a disk encryption, you can choose a form that is easy to pass on and hard to mistype.
A temporary shared password
Well suited to something shared within a team for a short period. Pasted into a chat, it is far less likely to be misread.
Passphrase Terms Explained
- Passphrase
- A password made by joining several words. It makes length easy to achieve and is straightforward to remember and to say aloud.
- Diceware
- A method that picks words from a list using dice or another source of randomness. This idea is the foundation of passphrase generation.
- Entropy
- An indicator that expresses how hard something is to guess, measured in bits. Each additional bit doubles the number of attempts a brute-force search requires.
- Brute-Force Attack
- An attack that tries every conceivable combination in turn. The length of a passphrase translates directly into resistance.
- Dictionary Attack
- An attack that tries commonly used words and passwords leaked in the past. Choosing words at random is what counters it.
- Web Crypto API
- The cryptographic facility built into browsers. It is what this tool uses to generate randomness that is hard to predict.
FAQ
Side Note — How "correct horse battery staple" changed the conversation
Diceware itself was devised by Arnold Reinhold in 1995, but it became widely known thanks to the webcomic xkcd, whose 936th strip (2011) compared a complex-looking but hard-to-remember password like "Tr0ub4dor&3" with a passphrase made of four plain words, "correct horse battery staple." The comic showed that the latter is actually harder to brute-force despite being far easier to memorize.
This apparent paradox comes down to information-theoretic entropy. Rather than widening the character set per position, picking several words from a large list accumulates more bits of randomness per selection. Even a list of around 853 words yields roughly 9.7 bits per word, so four words together already rival an 8-character password mixing letters, digits, and symbols.
There are practical trade-offs, though. Longer passphrases are more prone to typos, and reusing the exact word list means an attacker who obtains it effectively shrinks the search space to that list. For your most sensitive accounts, treat a generated passphrase as a memorable master password for a password manager rather than reusing it everywhere.