Word Password Generator
A password made of whole words rather than a run of symbols, so you can read it off a screen and type it into a television, a games console or a lock without a single mistake. This page opens at three words drawn from a bundled list of 2,048 common English words, which is 33 bits, and it says so plainly: three words is the count for a low-stakes login, and one tap takes you to five or six for anything that matters. Every word is drawn by your browser's cryptographic generator, in this tab.
Drawn in this tab the moment the page is ready
The length box takes any number from 4 to 128, so an 8, a 12 or a 16 character rule is one keystroke away. Turning a set off drops it from the pool and lowers the entropy shown; excluding look-alikes removes 6 characters (0 O 1 l I |) for a password you have to read off a screen and type somewhere else.
Common questions
- Is a three word password strong enough?
- For a shared television login or a guest network, yes. For your email, no. Each word is drawn from a list of 2,048, which is exactly 11 bits, so three words are 33 bits and this tool labels that weak: it is inside the reach of a machine grinding a stolen password file. Five words are 55 bits, six are 66, and 66 is where that attack stops being practical. The word count control is right there, and the strength readout changes as you press it, so you can decide with the number in front of you rather than by feel.
- Why words instead of random characters?
- Because you can type them. A run of symbols is fine when a password manager fills it in for you, and painful when you are entering it letter by letter on a remote control or reading it out over the phone. Words made of four to eight lower case letters survive that trip. The trade is length: a word password needs more characters to reach the same strength as a symbol password, which is why the honest move is to add words rather than to shorten the phrase.
- Where do the words come from?
- From a list of 2,048 English words bundled inside the page: four to eight letters each, lower case, no proper nouns and nothing anyone would mind reading out. Every entry is a real word in ENABLE, the public-domain word list this site already ships for its anagram solver, and the entries were chosen from everyday vocabulary. Nothing is downloaded, so this works with no connection, and the list is the same for everyone, which is what makes the 11 bits a word claim checkable.
- Can I join the words without a hyphen?
- Yes. The small box beside the style buttons sets the separator and takes up to four characters, and leaving it empty runs the words together as one string. A space is refused, because some password fields cut a phrase at the first space. You can also capitalise each word, which helps a site that demands a capital letter, though it adds nothing to the strength and the entropy figure does not move: it is a fixed rule, not a random choice.
- Should I add a number?
- Only if a site insists on one. The Add a digit button appends a randomly drawn digit after the last word, which is worth about 3.3 bits, roughly a third of what one more word gives you. If you have the choice between adding a digit and adding a word, add the word.
- Does the password leave my browser?
- No. It is drawn here from crypto.getRandomValues, it is not uploaded, not logged, not put into an analytics event and never written into the address bar, so it cannot leak through a shared link. Only your settings are remembered in this browser, and the record that is saved is rebuilt from a fixed list of options, so a generated password cannot reach storage even by accident.
Passwords and passphrases come from the browser's own cryptographic randomness, made on your device and never sent anywhere. The strength shown is the real entropy of the choices you made. It cannot know a site's own password rules.