Skip to content
StoutNook
Menu
Every tool runs in your browser. Your files never leave your device.

Passphrase generator

Make a passphrase from randomly chosen words, the diceware way: easy to remember and type, hard to guess. Pick how many words, a separator, and whether to add capitals or a number.

What do you want?
Between the words

Words are picked at random from the EFF's list of 7,776 easy-to-type words. Some sites require a capital or a number: switch those on if yours does.

Your passphrase
Generating…
Strong78 bits of entropy

Guessing it would take about 350 centuries on average for an attacker making 100 billion guesses a second, even knowing exactly how it was made.

The link keeps your settings, never the password.
  • Generated on your device, never sent
  • Free, no sign-up
  • Works on phone and desktop

How to make a strong passphrase

  1. 1

    Choose how many words: 6 is a good balance of strength and length.

  2. 2

    Pick what goes between them: hyphens are easiest to read back; spaces work on most sites.

  3. 3

    Switch on Capitalize or Add a number only if a site insists on them.

  4. 4

    Copy it, and if you need to remember it, picture the words as one odd little scene.

Features

  • The EFF word list

    7,776 short, familiar words chosen by the Electronic Frontier Foundation to be easy to spell and type.

  • Really random

    Every word is picked by your browser's cryptographic random generator, like rolling dice, but faster.

  • Strength in plain numbers

    Each word adds 12.9 bits. See the total and the guessing time as you change the length.

  • Made on your device

    The passphrase is never sent or stored, and share links keep only your settings.

Why passphrases work

A passphrase is strong for the same reason a random password is: the attacker has to search every possibility. With 7,776 words to choose from, each word is like picking one of 7,776 doors. Six words means 7,7766, about 221 sextillion combinations. Yet "cubicle-avenue-sprout-oxidize-mammal-reward" is something you can read out, type on a phone or remember after a few days of use.

LengthEntropyAverage time to guess*
4 words52 bits5 hours
5 words65 bits4 years
6 words78 bits350 centuries
7 words90 bits272 million years
8 words103 bitslonger than the age of the universe

*At 100 billion guesses a second, even for an attacker who knows the passphrase came from this word list.

Where a passphrase is the right choice

  • Your password manager's master password, the one password you must remember.
  • Computer and phone logins, and full-disk encryption such as BitLocker or FileVault.
  • Wi-Fi networks, where guests have to type it in.
  • Anything you type on a TV or game console, where symbols are painful to enter.

For everything else, let your password manager store a long random password from the password generator. The word list is the EFF Long Wordlist by the Electronic Frontier Foundation, used under the Creative Commons Attribution 3.0 US license.

Frequently asked questions

How many words should a passphrase have?

Six random words from the EFF list give about 77 bits of entropy, strong enough for a password manager master password or full-disk encryption. Five is fine for most website logins; go to seven or eight for anything very sensitive.

Can I pick the words myself?

No: words people choose are predictable, and attackers' lists include song lyrics, quotes and common phrases. The strength figures only hold when every word is picked at random, as here.

What is diceware?

A way to make passphrases by rolling five dice for each word and looking the number up in a list of 7,776 words. This generator does the same with a secure random number generator, using the same EFF list.

Does adding a number or capitals make it much stronger?

Only slightly, because attackers try those tweaks too. Adding one more word adds far more strength. Use them when a site's rules require them.

Some sites limit passwords to 16 or 20 characters. What then?

Use a random password from the password generator for those sites, and keep passphrases for things you type often, like your computer login or password manager.

More free tools