How this page works
Everything happens on your device. The words are picked in your browser by crypto.getRandomValues, the same random source browsers use for TLS, and all three wordlists are inside the page. There is no form submission, no analytics beacon on this page and no third-party script. You can check it yourself:
- Open your browser's developer tools (F12, or Cmd+Option+I on a Mac) and choose the Network tab.
- Press Generate a few times and change the options. Nothing new appears after the first load.
- Choose View Source. The page is one HTML file, a short script and the wordlists.
- Turn off your connection and generate again. It still works.
We say "nothing is sent" because the code cannot send anything, not because we promise not to look. The page carries a Content-Security-Policy with connect-src 'none', so the browser itself blocks any network call from it, and it loads no script from anywhere but this site.
Some generators run on a server, so the secret exists on someone else's machine. This one cannot. this page is already the downloaded copy as a single file and it works offline, with nothing to install. For your most important secrets, real dice are still the gold standard; see the Diceware section below.
How many words?
Every added bit doubles the number of guesses an attacker needs. Each word from the long list is worth log2(7,776), about 12.9 bits, and the figure assumes the attacker knows exactly how you made the passphrase, which is the safe assumption. EFF recommends six words for most uses. Use four or five only for accounts protected by a second factor or a rate-limited login, six for anything that matters, and seven or eight for a password manager master passphrase, disk encryption or an SSH key.
| Words | Long list (12.9 bits each) | Short lists (10.3 bits each) |
|---|---|---|
| 4 | 52 bits | 41 bits |
| 5 | 65 bits | 52 bits |
| 6 | 77 bits | 62 bits |
| 8 | 103 bits | 83 bits |
Length beats complexity. Most password rules ask for a capital, a number and a symbol, and people respond in predictable ways: a capital at the start, a number or an exclamation mark at the end, a letter swapped for a look-alike. Attackers know this, so those tricks add far less than they seem to. A short password packed with symbols might look strong, yet an eight-character one has about 52 bits at best, and far fewer when a person invents it. A string like "cactus-lunar-trench-oxygen-plank" is easier to remember and type than random characters of the same strength.
Do not pick words yourself, even if they feel random. Song lyrics, film quotes and favourite things are guessable. The strength comes from the random choice, so if you do not like a result, generate another set rather than swapping words by hand.
When a site limits you to 12 or 16 characters
Many sites still cap passwords at 12, 15 or 16 characters, although NIST's current guidance says sites should accept at least 64 and should accept spaces. The character count beside each result shows whether it fits. If it does not, switch the word list to Short and the separator to None. Short list #1 has words of five letters or fewer, at 10.3 bits each. Be realistic about the cost: about three such words fit in 16 characters, which is around 31 bits, far less than the 65 bits of five long-list words. Use that only where the cap is forced, and keep it for accounts protected by a second factor. If a site insists on a symbol, put it at the end; attackers already test that position, so it adds little, but it satisfies the rule.
The typo-tolerant list has longer words that differ from each other by at least three letters, so a misspelling can still be matched to the right word. It suits typing on a phone or reading a passphrase aloud, not short limits.
Diceware, the EFF wordlist and the xkcd comic
The Diceware method is Arnold Reinhold's 1995 idea. You take a numbered list of 7,776 words, which is 6 x 6 x 6 x 6 x 6, the number of outcomes from five six-sided dice. Roll five dice, look up the word with that number, and repeat until you have enough words. Because every word is equally likely, the result has no pattern an attacker can lean on. This page does the same job with your browser's random number generator in place of dice, and picks each word without bias towards any part of the list.
EFF published its own lists in 2016, with more familiar, easier-to-spell words than the original, and no word that is a prefix of another. The long list is 7,776 words. Short list #1 has 1,296 words (four dice) and short list #2 has 1,296 words chosen so typos can be corrected. If you would rather not trust a web page, EFF's dice page explains the manual method; the result is just as good. Dice remain the gold standard, and this page is a convenience.
The xkcd comic "Password Strength" made the idea popular with four words at about 44 bits. That was a floor in 2011 and is low today. Use more words.
Passphrase or passkey?
The best password is the one you never type. A passkey replaces the password with a key pair held on your phone or computer. The site stores only the public half, so there is nothing to steal in a breach and nothing to phish, because the key works only on the real site. Where a site offers passkeys, use them. Where it does not, a passphrase is the fallback, and it is the right secret for the places that unlock everything else: your password manager and the device that holds your passkeys. If you run your own web apps and want passkey sign-in in front of them without changing the apps, that is what Gatekeeper does.
Using the numbers
Never reuse a secret. When one site leaks its password database, attackers try the same email and password everywhere else. Use a password manager for the many unique passwords nobody can memorise, and keep a few strong passphrases for the manager's master secret, your computer login and your phone code. Write the master passphrase on paper and keep it somewhere safe at home until it is second nature.
The time to guess table shows the average case, which is half the possible guesses. Online logins are throttled, so 10 thousand guesses a second is generous. A stolen, fast-hashed file can be attacked at billions per second, and the 1 trillion row covers a well-funded attacker with specialised hardware. If your secret holds up in the harshest row, it holds up anywhere. A capital letter at the start of each word adds no bits as implemented here, because it always falls in the same place.
Frequently asked questions
How do you create a passphrase?
Pick several words completely at random and join them, for example with dashes. Do not choose the words yourself, because people choose predictable ones. This page does the picking with your browser's secure random generator from the EFF wordlist, or you can roll five dice per word and look each number up in the list. Five or six words from the long list is a good starting point.
What is an example of a good passphrase?
A good passphrase is several random words, such as example-lunar-trench-oxygen-plank-cactus. That one is only an illustration, and it is now public, so never use it. It has five words from a 7,776-word list, which is about 64.6 bits. Generate your own above; the words matter less than the fact that they were chosen at random.
How many words should a passphrase be?
Five words from the long list is a floor for an account with a rate-limited login, and six is the usual recommendation. Use seven or eight for a password manager master passphrase, disk encryption or an SSH key. Each long-list word adds about 12.9 bits: 4 words is 52 bits, 5 is 65, 6 is 77 and 8 is 103.
Is a passphrase better than a password?
For secrets you must type or remember, yes: a random passphrase is easier to type and remember than a random character string of the same strength. For accounts a password manager fills in for you, a random string from the manager is just as good. NIST and the UK NCSC both favour length over composition rules.
Is a password generator safe to use online?
It depends on where the random choice happens. Some generators run on a server, which means the secret exists on someone else's machine. This page runs in your browser, uses crypto.getRandomValues, and its Content-Security-Policy forbids the page from making any network connection, which you can confirm in your browser's developer tools. You can also save the page and use it offline.
Does this page see my passphrase?
No. The passphrase is built in your browser and shown on your screen. The page has no form submission and no analytics, and its Content-Security-Policy sets connect-src to none, so the browser refuses any attempt by the page's code to send data. The box that checks your own passphrase works the same way: what you type stays in the page.
Is this a 24-word wallet seed phrase generator?
No. A crypto wallet seed phrase uses the BIP-39 word list of 2,048 words and includes a checksum, and wallets expect that exact format. The EFF lists here have no checksum and would not be accepted as a seed phrase. Create wallet seeds in your wallet software or hardware wallet.
What is the difference between a passphrase and a passkey?
A passphrase is a secret made of words that you type. A passkey is a key pair held on your device that signs you in with a fingerprint, face or device PIN, so there is nothing to type and nothing to phish. Use passkeys where a site offers them and a passphrase where it does not, and for the secrets that unlock your passkeys, such as a password manager or device login.
Can I use a passphrase for Wi-Fi?
Yes. Four or five words with a dash is easy to read out to a guest, and WPA2 and WPA3 keys can be up to 63 characters, so there is plenty of room. Use six words if the network protects something sensitive.
Could quantum computers crack my passphrase?
In theory, Grover's algorithm would roughly halve the effective bits, so a 77-bit passphrase would behave like about 38 bits against a large quantum computer. No such machine exists for this job today, and password guessing parallelises poorly on one. If you worry about it, add words: eight long-list words is 103 bits, about 51 after halving. Reuse and phishing are the practical threats.