How to use the passphrase generator
- A passphrase of eight random words appears when the page loads. Press “Copy passphrase” to use it.
- Move the slider to choose between 4 and 12 words. Every extra word multiplies the number of possible passphrases by 7,776.
- Pick a separator. Hyphens and spaces are easy to read; choose another if a site refuses them.
- Tick “Capitalise each word” or “Add a number” when a site insists on capitals or digits.
- Store the passphrase in a password manager or learn it by heart before you leave; the page keeps no copy.
How the words are chosen and the entropy is calculated
The list is the EFF large wordlist, published for dice-based passphrases: 7,776 words, one for every result of rolling five six-sided dice (6⁵ = 7,776). The words are common, three to nine letters long and picked to be easy to spell. A copy of the file is stored on this site, so no other server is contacted.
Instead of dice, the tool uses crypto.getRandomValues. A 32-bit random number is accepted only if it falls below the largest multiple of 7,776 that fits in 32 bits; anything above that limit is discarded and drawn again. This rejection sampling gives every word exactly the same chance, which a plain remainder (modulo) would not.
Worked example
With the default eight words, entropy is 8 × 12.925 = 103.4 bits, rated Strong. That is 7,776⁸ ≈ 1.35 × 10³¹ possible passphrases. Adding a number contributes log₂(80) ≈ 6.3 bits, for 109.7 bits in total, while ten words give 129.2 bits, rated Very strong.
Why the attacker is assumed to know the list
The figures assume the worst case: an attacker knows you used this exact list, how many words you chose and which separator. Security then rests only on the random choices, which is why the number holds when the generator picks the words, not you. A phrase you invent, a song line or a quotation has far less entropy than its length suggests.
Quantum computers and passphrases
Grover’s algorithm would let a large quantum computer search N options in roughly √N steps, so in theory it halves the effective bits of a random passphrase. Eight words keep about 51.7 bits against such a search. Ten or more words (129 bits and up) stay strong against brute-force guessing, including future quantum attacks, because around 64 bits of work remain. Post-quantum standards such as ML-KEM and ML-DSA protect key exchange and digital signatures; they do not change how a passphrase should be built.
Key features
- Words from the 7,776-word EFF large list, selected with the Web Crypto API and rejection sampling.
- 4 to 12 words, five separators, optional capitals and an optional digit.
- Live entropy in bits, a strength rating and the halved figure for a quantum search.
- No account and no record of what you generate; once loaded, it keeps working offline.
Practical use cases
Password manager master password. This is the one secret you must remember and type often, so eight to ten words are a sensible length.
Device and disk encryption. A passphrase for full-disk encryption or a laptop login is easier to type correctly on a start-up screen than a string of symbols.
Shared Wi-Fi. Words are simpler to read out to guests than random characters, and the QR code generator can turn the network details into a scannable code.