Passphrase Generator

Most passphrase makers hand you a row of words and a refresh button, then leave you to wonder whether the thing is actually strong. This one puts a real number on it. Right under the box it shows roughly how long a fast offline attacker would take to break what you just made, in plain time you can read, seconds or days or a few hundred thousand years, not a vague colored bar. And if you have no idea how long a phrase should be, the preset buttons jump you straight to a length that fits the job. Six words for email or banking, eight for a password manager key, ten for an encrypted disk. The batch tools most generators skip are here too, but the part worth coming back for is that this one tells you the truth about the phrase in front of you instead of just calling it "good" and moving on.

A passphrase is a plain idea. Instead of one short password twisted into k9#Lm2!q, you string together a few ordinary words picked at random, so you get Clover-Anchor-Frost-Ember. You can picture that and type it. The scrambled character password is the one you forget by lunch, and word for word, a phrase built from real words is actually harder for a computer to guess.

Set the tool to four words and watch the timer. Against a serious attacker it falls in seconds, because four common words are not much to search through, and an ordinary strength bar hides that from you. The meter and the timer here both point you toward the same fix, adding a word. One more word multiplies the crack-time by about a thousand, far more than a number stuck on the end ever adds.

1. A passphrase is waiting when the page loads. Tap the refresh arrow or Regenerate for a new one, rerolling costs nothing, so keep pulling until the words are easy to picture.
2. Pick a preset, or drag the slider yourself. Email or banking sets six words, Password manager key sets eight, Disk encryption sets ten. Watch the crack-time under the box climb as you go.
3. Choose a separator: hyphen, space, period, underscore, or none. Hyphens are the safe default, accepted almost everywhere and no shift key needed.
4. Flip Capitalize each word if a site demands an uppercase letter, and Add a random number if it insists on a digit.
5. Need more than one? Type a count into How many and the tool switches to a scrollable list with a Copy all button.
6. For a big run, open Bulk download, enter a number up to one hundred thousand, and save them to a .txt file built on your device.
7. Copy your pick into your password manager before you close the tab. Nothing here is saved for you, and there is no undo.

The number under the box is built from the phrase's entropy, the count of guesses an attacker has to grind through, measured against a fast offline attack. The number is there to compare two settings against each other, not to count down to a real break. Four words showing seconds next to eight words showing a number too long to say out loud is exactly the lesson. Most free tools bury that behind a green bar that reads "strong" at five weak words and "strong" again at ten, so you never learn where the real drop-off is, which is the number this tool shows you directly.

The short tricky password has a weakness most people miss. Nobody remembers a truly random eight-character string, so people build one from a dictionary word, a capital in front, and a 1! on the tail. Attackers know that recipe cold and test those swaps first, so the password that feels clever is often among the first they try.

A passphrase avoids the trap by stacking several unrelated words each chosen by chance. Every word this tool adds is worth about ten bits, so four words lands in the low forties, six in the sixties, eight crosses eighty. The rule that never bends is to let the computer pick. People lean on the same nice-sounding nouns, which pulls a "random" phrase back toward guessable, and a line from a song or a film is worse still, attackers test those first.

Once the words are chosen, the rest is mostly about clearing a site's rules, not adding real strength. A hyphen is the practical choice for most people. It survives phone autocorrect, needs no shift key, and gets accepted almost everywhere. Spaces read the most naturally, though some older systems trim them. Drop the separator and you get riverottermaplestone, exactly as strong on paper but harder to read back. Capitalizing each word or adding a number mostly satisfies a form that demands an uppercase letter or a digit, so be honest about what they buy. Capitals land on every word the same way every time, which is a rule an attacker can apply just as easily, so the timer does not move for those. The number does move it, because it is drawn at random from 0 to 99, and at the four words the page opens on, flipping it on takes the crack-time from five seconds to twelve minutes. Another word is worth roughly ten times more than that though, and you can watch both of those happen under the box.

The batch tools are the part I would miss on a lesser generator. Onboarding fifteen new hires who each need a temporary password, or a teacher setting up thirty student logins before Monday, one phrase at a time is miserable. Set How many to see a stack on screen and grab the lot with one button. For anything larger, Bulk download spins up as many as one hundred thousand phrases and hands you a text file for a spreadsheet or a provisioning script. It builds them in chunks so the page stays responsive, and the whole batch is made in your browser, so a file full of credentials never sits in some stranger's logs.

A passphrase you make here might become the master key to your whole vault, the one credential you cannot store inside the manager because it is the key that opens the manager. If a site sent that value to a server, even for a moment, you would have to treat it as burned. Local generation removes that worry, and you can even switch your wifi off and keep generating all day. When the tab closes, nothing about them is kept.