Secure Passphrase Generator
Diceware-style passphrases you can actually remember, with the entropy shown.
Generate a Passphrase You Can Actually Remember
A random string of twelve characters is strong and impossible to remember, so people write it down or reuse it. Four random common words are easier to remember than a phone number and, drawn from a list of two thousand words, carry about 44 bits of entropy — stronger than most passwords people actually choose.
The word "random" is doing the work there. Words you pick yourself are not random; they cluster around what you were thinking about. This generator uses crypto.getRandomValues, the browser’s cryptographic source, and shows you the real entropy for the settings you chose.
Key features
- Cryptographic randomness —
crypto.getRandomValues, neverMath.random, which is unsuitable for anything security-related. - Honest entropy figure — calculated from the word list size and count, with a crack-time estimate that states its assumptions.
- Adjustable length — three to ten words, with your choice of separator, capitalisation, and an optional digit and symbol for sites that demand them.
- Generate in batches — one, five, ten or twenty-five at a time, so you can pick the one that sticks in your head.
- Curated word list — common, easily spelled words, because a passphrase you cannot type is a passphrase you will not use.
- Generated locally — nothing is transmitted, logged or stored anywhere.
This tool runs entirely inside your browser using native Web APIs. Your files and text are never uploaded to a server, never logged and never shared with third parties.
How to use: Secure Passphrase Generator
- Choose the word count
Four is a sound minimum; five or six for anything important, such as a password manager master password. The slider goes to ten. - Pick a separator
Hyphens, dots or spaces. Some systems reject spaces, so hyphens are the safe default. - Add capitals or a number if required
Only because some sites demand them — they add very little entropy compared with another word. - Generate and check the entropy
Ask for a batch and pick the one that sticks in your mind — the entropy is identical whichever you choose, so choosing costs you nothing.
Technical specifications
| Processing location | Entirely in your browser — no server round trip |
|---|---|
| Data uploaded | None. Files and text never leave your device |
| Price | Free — no account, no trial, no usage cap |
| Category | Security |
| Works offline | Yes, once the page has loaded |
| Browser support | Chrome 90+, Edge 90+, Firefox 90+, Safari 15+ |
| Interface languages | English, 中文, हिन्दी, Español, العربية |
Frequently asked questions
Is a passphrase really stronger than a complex password?
Often, in practice. "P@ssw0rd!" follows a predictable substitution pattern that cracking tools try first. Four genuinely random common words have no such structure, and length punishes brute force exponentially. Both need to be actually random to hold up.
Does adding numbers and symbols help much?
Barely. Appending a digit adds about 3.3 bits; adding a fifth word adds around 11. If you have the choice, choose more words. Add symbols only when a site forces you to.
Is it safe to generate a passphrase in a browser?
With <code>crypto.getRandomValues</code>, yes — it is the platform CSPRNG, the same source used for TLS key material. The passphrase never leaves the page. The remaining risk is your own device, which applies to every method.
How many words do I need?
Four for ordinary accounts, five or six for a password manager master password or anything protecting the rest. Each extra word multiplies the search space by the size of the list.