Developer Security

Passphrase generator

Strength Weak
0 bits of entropy · guessed instantly
Joined by

Generated in your browser · never sent, never stored

Local · words chosen with crypto.getRandomValues
Advertisement
320 × 100

A passphrase is several unrelated words picked at random. It is easier to remember and to type than a random string of the same strength, which matters for the handful of passwords you have to know by heart; your device login, your password manager’s master password, your disk encryption.

How to generate a passphrase

1 Choose how many words. Five is a good default; four is the minimum worth using.
2 Pick a separator. Hyphens are the most compatible; some systems reject spaces.
3 Tap to copy. Say it to yourself a few times, that is the whole advantage of this format.

The strength comes only from the randomness of the choice, not from the words themselves. Each word contributes log2(list size) bits, so a five-word phrase from a list of thirty thousand words is about seventy-four bits. Comfortably stronger than a twelve-character random password. The meter here reads the actual list in use rather than quoting a number from somewhere else. One warning worth taking seriously: choosing the words yourself destroys this entirely. People reach for related words, and a phrase like "correct-horse-battery-staple" is now in every cracking dictionary precisely because it became famous.

Questions

Four is the practical minimum, five is comfortable, six for a master password or disk encryption.

NIST SP 800-63B, digital identity guidelinesMDN, Crypto.getRandomValues()
Advertisement
300 × 250
Was this tool any good?
Internal signal only · I use it to find the tools worth rebuilding