Passphrase Generator
Generate strong, memorable passphrases from random words, with live entropy and crack-time estimates.
- Entropy
- 60 bits
- Strength
- Strong
- Offline crack time
- —
Word list: 1024 short, easy-to-type English words —
exactly 10 bits of entropy per word. Words are drawn with
crypto.getRandomValues, never Math.random().
How it works
A passphrase is a password made of random words — tiger-lantern-cobalt beats
Tr0ub4dor&3 because it is both longer and far easier to remember. This
generator picks each word independently from a 1,024-word list using your browser's
cryptographic randomness source (crypto.getRandomValues) with rejection
sampling, so every word is equally likely and there is no modulo bias. Each word adds
exactly 10 bits of entropy: six words give 60 bits, eight words give 80 bits. The strength
panel shows the real entropy of your settings plus an estimated offline crack time at one
trillion guesses per second — the number an attacker with stolen password hashes could
realistically manage.
Choose how many words you want, pick a separator your password manager and login forms are happy with, and optionally append a digit or a symbol to satisfy sites that insist on them. Generate a batch of up to 50 at once, then copy the list or download it as a plain text file. Everything happens in your browser: no passphrase is ever sent to a server, logged or stored, so unlike ad-supported generators there is nothing to leak.
Frequently asked questions
How many words should a passphrase be?
Six words from this 1,024-word list gives 60 bits of entropy, which is plenty for everyday accounts. Use seven or eight words (70–80 bits) for a password manager master password, your email, or anything protecting money. Fewer than four words is too weak for anything that matters.
Are passphrases more secure than passwords?
For the same amount of typing, yes. Attackers crack passwords by trying dictionary words with predictable substitutions, so "Tr0ub4dor&3" falls fast. A passphrase of genuinely random words has measurable entropy — six random words is 60 bits, roughly a quintillion combinations — and it is far easier to remember and type.
Is this passphrase generator safe to use?
Yes. Everything runs in your browser: the word list is part of the page, words are picked with the browser's cryptographic randomness source (crypto.getRandomValues, using rejection sampling so there is no bias), and no passphrase is ever sent to a server, logged or stored. Reload the page and every generated passphrase is gone.