Passphrase Generator
This page opens as a passphrase of four words, joined by a hyphen until you change the separator, drawn one word at a time from a bundled list of 2,048 common English words by your browser's cryptographic generator. The list size is the whole point: 2,048 is 2 to the power 11, so every word is exactly 11 bits and four words are exactly 44. Raise the count and the arithmetic stays this simple, which is why the readout can tell you what your phrase is worth instead of colouring a bar.
Drawn in this tab the moment the page is ready
The length box takes any number from 4 to 128, so an 8, a 12 or a 16 character rule is one keystroke away. Turning a set off drops it from the pool and lowers the entropy shown; excluding look-alikes removes 6 characters (0 O 1 l I |) for a password you have to read off a screen and type somewhere else.
Common questions
- How many words do I need?
- Each word is 11 bits, so three words are 33 bits, four are 44, five are 55, six are 66 and eight are 88. Four words is fine for a low-stakes account behind a login form that counts failed attempts. Six words, at 66 bits, is where an attacker holding a stolen password file runs out of road, and it is the count to use for anything that matters. The strength word under the phrase moves with the count, so you can see the change before you copy it.
- Where do the words come from?
- From a list of 2,048 English words bundled inside the page, every one of them four to eight letters, lower case, no proper nouns and nothing anyone would mind reading out. Every entry is a real word in ENABLE, the public-domain word list this site already ships for its anagram solver, and the entries were chosen from everyday vocabulary so the phrase can be read aloud and typed from memory. Nothing is downloaded, so the tool works with no connection.
- Does capitalising the words make it stronger?
- No, and this tool will not pretend otherwise. Capitalising every word is a fixed rule applied after the draw rather than a random choice, so it adds no entropy at all and the figure on screen does not move when you turn it on. Use it if a site demands a capital letter. Adding a random digit at the end does add about 3.3 bits, because that digit really is drawn at random, and the figure moves accordingly.
- Is a passphrase weaker than a password full of symbols?
- Not at the same entropy, and the entropy is the thing to compare. A six word passphrase is 66 bits; a ten character password from all four sets is about 65. Those are the same size of problem for an attacker, and the passphrase is the one you can read off a screen and type into a games console without a mistake. Where passphrases go wrong is picking the words yourself: a phrase from a song or a film is not 11 bits a word, because an attacker guesses phrases as well as words. Every word here is drawn by the machine, which is what keeps the arithmetic true.
- Can I change the separator?
- Yes. The small box beside the style buttons takes up to four characters, and a space is refused because some password fields cut a phrase at the first space. Leave it empty to run the words together. The separator is not part of the strength calculation, because it is your choice rather than a random one, so the entropy figure does not move when you change it.
- Is the phrase sent anywhere?
- No. It is drawn in this tab, it is not uploaded, not logged, not put into an analytics event and never written into the address bar. Only your settings are remembered in this browser, and the saved record is rebuilt from a fixed list of options, so a generated phrase cannot reach storage even by accident.
Passwords and passphrases come from the browser's own cryptographic randomness, made on your device and never sent anywhere. The strength shown is the real entropy of the choices you made. It cannot know a site's own password rules.