Passphrase Generator

About the Passphrase Generator

This builds passphrases from several random words — the correct-horse-battery-staple approach — which are far easier to remember and type than a random tangle of symbols, yet can be just as strong. They're a good fit for the handful of passwords you actually have to memorise: your device login, your password-manager master password, or an encryption key. You choose how many words, the separator between them, and whether to capitalise or add a number. It doubles as a secret-phrase generator: generate a passphrase with one click and regenerate until you get words that are easy to picture but hard to guess.

Need a random-character password instead, or a numeric PIN? Try the Password Generator or the PIN Generator.

How it works

Each word is chosen from a wordlist of 724 common words (the same technique behind our Random Word Generator) using your browser's cryptographically secure random generator, with rejection sampling so every word is equally likely (no statistical bias). You control:

• Number of words — more words means a stronger, longer passphrase.
• Separator — space, hyphen, dot, etc., joining the words.
• Capitalise each word, and optionally append a number (0–99).

Because the wordlist has 724 entries, each random word adds about 9.5 bits of entropy, so a four-word passphrase is roughly 38 bits and a six-word one about 57 — and, crucially, the strength comes from the random selection, not from being clever.

Why passphrases work

A passphrase's strength depends on the number of words and the size of the wordlist it's drawn from — not on looking complicated. Four to six truly random words are both memorable and hard to brute-force, which is why security guidance increasingly favours them over short cryptic passwords people can't recall (and therefore reuse). The catch is that the words must be chosen randomly by a tool like this; a phrase you pick yourself from a song or saying is not random and not secure.

Assumptions and behaviour

• Words are selected with secure, unbiased randomness from a 724-word list (~9.5 bits per word).
• More words = more entropy. Adding words strengthens a passphrase far more than adding a single trailing number.
• The optional number (0–99) is a small addition (under 7 bits) — a convenience for sites that demand a digit, not a real strength boost.
• Capitalisation and separator are cosmetic/compatibility choices and don't materially change strength.

Limitations

• Passphrases are longer to type than short passwords — the trade-off for memorability and strength.
• Some sites cap password length or forbid spaces; pick a shorter separator or fewer words if a site rejects it.
• Its strength assumes the words stay random — don't reorder them into something meaningful, which reduces the randomness that makes it secure.
• The wordlist is English; the words won't be memorable in the same way for non-English speakers.

Privacy

Passphrases are generated entirely in your browser with its built-in crypto. Nothing is uploaded, logged, or stored.