Contact

Tools  /  Security  /  Passphrase Generator

SECURITY

Passphrase Generator

Real diceware passphrases from the authentic EFF wordlists -- 7,776 or 1,296 words, true entropy math, QR export and bulk generation.

More Security tools

JWT Structure Viewer JWT Expiration Checker JWT Claims Viewer Checksum Calculator SHA File Checker HTTP Security Header Reference

What this tool does

Builds a passphrase from randomly chosen dictionary words — the "diceware" method — using the real, publicly-published EFF Large wordlist (7,776 words, the modern diceware standard) or the EFF Short wordlist (1,296 words, shorter words that are faster to type on a phone). Every word is chosen with crypto.getRandomValues and unbiased rejection sampling, the same approach this site uses for every other generator — not Math.random(), and not a biased modulo shortcut.

Why word count matters more than word list tricks

Entropy here is simply words × log2(list size). The original diceware method (rolling five six-sided dice per word against a 7,776-word list) gives ~12.925 bits per word — six words is already ~77.5 bits, comparable to a fully random 13-character password. A shorter, smaller word list doesn't ruin this, but it does cost real bits per word: the 1,296-word EFF Short list gives ~10.34 bits per word, so matching 77.5 bits needs about 8 words instead of 6. A toy list of only a few dozen words — which is all some "diceware-style" generators actually use — gives under 6 bits per word, meaning even ten words from it can fall short of 60 bits. List size is not cosmetic; it is the entire entropy budget per word.

Standard vs. Short: which wordlist to use

The Standard list (EFF Large, 7,776 words) is the modern diceware reference list and the default here — fewer words needed for the same entropy, at the cost of some longer/rarer words appearing occasionally. The Short/Memorable list (EFF Short, 1,296 words) sticks to shorter, more common words, which trades some entropy-per-word for faster typing, especially on a phone keyboard — plan on roughly two extra words to reach the same strength as the Standard list.

Formatting options and what actually adds entropy

Separator choice (hyphen, dot, underscore, space, none, or your own), and capitalizing every word or shouting the whole thing in uppercase, make a passphrase easier to read but are deterministic — they don't add any entropy, because an attacker already knows the rule. Random-per-word capitalization does add a real bit per word, since each word's case is now an independent coin flip. Appending random digits and inserting a random symbol at a random position both add their own real, counted bits on top of the word entropy — useful for sites that insist on a digit or symbol regardless of overall strength.

Avoiding repeated words

By default, the same word is never chosen twice in a row — mostly a readability nicety on the huge Standard/Short lists (the odds of a repeat are already tiny), but genuinely relevant on a small custom word list, where it meaningfully reduces accidental repetition without materially changing the entropy math.

Custom wordlist mode

Paste your own list (one word per line, or comma/space separated) to use a word list specific to a language, theme, or memory aid. Entries are deduplicated automatically. A custom list under a couple hundred words will have noticeably less entropy per word than the EFF lists — the live entropy figure always reflects whichever list is actually active, so there's no guessing.

Crack-time estimates across four scenarios

The same passphrase can be centuries away from being cracked in one scenario and seconds away in another, so a single number would be misleading. Estimates are shown for an online rate-limited login (~100 guesses/hour), an online unthrottled login (~10/sec), an offline attack against a slow hash like bcrypt (~10,000/sec), and an offline attack against a fast unsalted hash like raw MD5 (~10 billion/sec).

Privacy

Every word, digit and symbol is drawn from crypto.getRandomValues entirely in your browser using unbiased rejection sampling against the active list length. Nothing is sent to a server. Session history exists only in this tab's memory and disappears the moment you reload or leave the page.

FAQ

Frequently asked questions

Is this real diceware, or just word-shaped randomness?
Real diceware -- it uses the authentic, publicly-published EFF Large (7,776-word) and EFF Short (1,296-word) wordlists, the same ones referenced by the modern diceware standard, not a small hand-picked list. Selection uses crypto.getRandomValues with unbiased rejection sampling instead of physical dice, which is equally random and far faster.
How many words should I use?
Six words from the Standard (EFF Large) list is about 77.5 bits of entropy, comparable to a fully random 13-character password, and is a reasonable baseline for most accounts. Use more words for something higher-value, or switch to the Short list and add roughly two extra words if you want shorter, easier-to-type words at similar strength.
Why does the Short wordlist need more words for the same strength?
Entropy per word is log2(word list size). The Short list has 1,296 words (~10.34 bits/word) versus the Large list's 7,776 words (~12.925 bits/word), so it takes more words from the Short list to reach the same total entropy.
Do capitalization and separator choices make it stronger?
Capitalizing every word, shouting in uppercase, and choosing a separator are all deterministic rules an attacker can assume, so they add no entropy on their own. Only "random per word" capitalization, appended random digits, and the random symbol insertion add real, counted bits, because each is an independent random choice.
Can I use my own word list?
Yes -- switch to Custom and paste your own words (one per line, or separated by commas or spaces). Duplicates are removed automatically. The entropy figure always reflects the actual size of whichever list is active, so a short custom list will honestly show lower entropy per word.
Why four different crack-time estimates?
Because the realistic answer depends entirely on how it's attacked -- a rate-limited login form, an unthrottled one, a leaked database hashed with a slow algorithm like bcrypt, or one hashed with a fast algorithm like raw MD5. The same passphrase can be centuries in one scenario and seconds in another.
Is this actually random, or just random-looking?
It uses crypto.getRandomValues(), the Web Crypto API's cryptographically secure random source, with unbiased rejection sampling against the exact size of the active word list -- not Math.random() and not a biased modulo shortcut.
Is anything I generate or paste uploaded anywhere?
No. Generation and any custom word list you paste stay entirely in your browser. The session history is kept only in this tab's memory -- never written to localStorage or sent anywhere -- and disappears as soon as you reload or close the page.
Theme Accent