Passphrase Generator

The Passphrase Generator builds strong, memorable passwords out of random everyday words — the Diceware approach favored by security professionals. Instead of a cryptic string like k9#Lm2!q, you get something like Clover-Anchor-Frost-Ember that is far easier to remember yet, because the words are chosen at random from a fixed list, extremely hard to guess. Each word is picked by your browser's built-in cryptographic random number generator (crypto.getRandomValues) using unbiased rejection sampling, so every word is equally likely. Nothing is ever transmitted or stored — the passphrase exists only in your browser, only while the page is open.

The idea is simple: length beats complexity. A handful of truly random words creates a huge number of possible combinations, which is exactly what defeats brute-force and dictionary attacks. Because the words are common and easy to type, a good passphrase is practical for the passwords you actually have to remember — your device login, your password manager's master password, or an email account.

1. A fresh passphrase appears automatically. Click ↻ any time to roll a new one.
2. Set the number of words with the slider. Four is a sensible default; five or six is recommended for anything important. More words means more strength.
3. Choose a separator — hyphen, space, period, underscore, or none — to match a site's rules and your own taste. Hyphens are readable and widely accepted.
4. Toggle "Capitalize each word" to satisfy sites that require an uppercase letter and to make the passphrase a little easier to read.
5. Toggle "Add a random number" if a site demands a digit, or just for a touch more entropy.
6. Click Copy passphrase and paste it into your password manager or the signup form.

The strength meter shows the approximate entropy in bits, calculated as words × log₂(wordlist size). With a 256-word list that's about 8 bits per word, so four words is roughly 32 bits, five words about 40 bits, and six words about 48 bits before any number is added.

Random passphrases hit a rare sweet spot: they are both strong and human-friendly. A random character password of equal strength is nearly impossible to memorize, so people reuse or write it down — the very habits that lead to breaches. A passphrase made of ordinary words can be committed to memory after a couple of uses, while the randomness keeps attackers guessing. The critical point is that the words must be chosen randomly by a computer, not picked by you: a phrase from a song, book, or common saying has almost no entropy because attackers try those first. This tool does the random selection for you, which is what makes the result trustworthy.