Overview
A passphrase trades character soup for a short string of unrelated words. Four or five ordinary words glued together are far easier to hold in your head than a dozen random symbols, yet the combination can be just as hard for a computer to stumble upon — provided the words were picked randomly, not chosen for what they mean to you. That picking is what this tool does, using your browser's cryptographic random source rather than a predictable shuffle.
You control the shape of the result. Choose between three and eight words, pick the character that joins them, decide whether each word starts with a capital, and optionally tack a random digit onto the end for sites that insist on one. The entropy estimate updates with every choice, using the same arithmetic explained below, so you can see what each extra word buys you.
What is a passphrase?
A passphrase is a password built from whole words. Its strength does not come from complexity you can see, but from the size of the haystack: if each word is drawn fairly from a list of around 150 candidates, every word multiplies the number of possible phrases by that same factor. Four words give hundreds of millions of combinations; six words push the count past what casual guessing can ever reach, and each word also tends to make the phrase longer than a typical character password, which many systems reward.
The catch is that the words must be genuinely random. A favourite song lyric, a famous quotation or your dog's name followed by your street is not a passphrase in this sense, because attackers try exactly those combinations first. Let the generator pick, and resist the urge to swap a word because another one "feels luckier" — that feeling is precisely the bias randomness is there to remove.
Features
- Three to eight words per phrase, adjusted by slider or number box so you can match the rules of the site you are signing up for.
- A built-in list of common, easy-to-spell English words — no obscure vocabulary you will mistype on a phone keyboard.
- Four separator styles: hyphen, underscore, space or dot, for systems that accept some characters and reject others.
- Optional capitalisation of every word, which satisfies "must contain an uppercase letter" rules without any extra effort.
- Optional trailing number, drawn at random and appended when a site demands a digit.
- An honest entropy estimate, calculated from word count and list size, shown in bits with a plain strength label.
- Cryptographic word selection with rejection sampling, so every word on the list is equally likely.
- Live regeneration and one-click copying, with no accounts, no history and nothing retained after you leave.
Benefits
- Memorable by design. A phrase of familiar words sticks in the mind after a few uses, which makes it ideal for a master password you must type from memory.
- Friendly to type. Words are far less error-prone on phone keyboards and TV remotes than strings of symbols.
- Private by architecture. The phrase is assembled in your browser; there is no server copy that could ever be leaked.
- Measurable strength. The estimate is arithmetic, not marketing — add a word and watch the number climb.
Who can use it
Anyone who needs a strong secret they will sometimes type by hand: the master password for a password manager, a laptop login, a Wi-Fi key read out to guests, or an encryption passphrase for backups. It also suits people who find symbol-heavy passwords hard to work with — a password people avoid using soon gets replaced by a weaker one. Teams can use it for shared credentials that must be spoken over a call without spelling out every character.
How to use
- Start with four words for ordinary accounts, or five to six for a master password or anything protecting valuable data.
- Pick a separator the destination accepts. Hyphens are the safest default; choose spaces only where you are sure they are allowed.
- Leave capitalisation on if the site requires an uppercase letter, and add the trailing number if it requires a digit.
- Read the entropy estimate and aim for a label of strong or very strong for important accounts.
- Press Copy passphrase, paste it where it belongs, and store it in your password manager. Generate a different one for every account.
Frequently asked questions
Is a passphrase really as safe as a random character password?
It can be, once it is long enough. Safety is measured in entropy, not in how messy a password looks. A randomly drawn five-word phrase from this list carries more entropy than most eight-character passwords people actually use, and it has the practical advantage that you will remember it instead of writing it on a note.
How is the entropy estimate calculated?
Each word contributes the base-2 logarithm of the list size — a little over 7 bits for a list of this size — multiplied by the number of words. A trailing digit adds about 3.3 bits, and capitalisation is counted at roughly one bit per word. The total assumes the attacker knows exactly how the phrase was built, which is the honest way to estimate.
Can I swap a word I do not like?
You can press Generate new for a completely fresh phrase, and that is fine. What weakens the result is hand-picking replacements until the phrase describes your hobbies or your family — at that point it stops being random. If a word is hard for you to spell, regenerating the whole phrase is the safer fix.
Why not just use a sentence I make up myself?
Because sentences follow grammar and habit, and cracking tools model both. Phrases assembled from common quotations, lyrics and personal facts are tried early in an attack. A random draw from a word list has no grammar to exploit — the words are neighbours by chance alone.
What if a website limits password length?
Reduce the word count to three and shorten the separator effect by choosing a dot or hyphen. Three random words still beat most human-invented passwords. If a site caps passwords at a very short length, that is a warning sign about the site itself, and the account deserves extra care such as two-factor authentication.
Does the generator keep a copy of my passphrase?
No. The words are selected in your browser's memory and vanish when the tab closes. Nothing is sent over the network, written to storage, or shown to anyone else — the same design as every tool on this bench.
Conclusion
When a password has to live in your head rather than in a manager, words beat symbols. Let the generator draw them fairly, take five or six for anything important, and you get a secret that is pleasant to type and tedious to attack.