Passphrase Generator

Words chosen by dice, not by you

The method is Arnold Reinhold’s, published in 1995 as Diceware: number a list of words, roll physical dice to pick them, and the strength of the result is arithmetic rather than opinion. This tool replaces the dice with the browser’s cryptographic random number generator and keeps everything else, including the part people skip — the machine picks the words, and picking them yourself invalidates the whole calculation.

The reason is that human choices cluster. Left to ourselves we reach for the same few hundred nouns and arrange them into something that reads like a sentence, which is a far smaller set than the list makes available and a set an attacker can enumerate. A phrase that sounds random and a phrase that is random look identical on the page and differ by many orders of magnitude underneath.

It is the memorable half of a pair. The password generator draws single characters and produces something shorter and stronger per keystroke; this one is for the two or three secrets you have to hold in your head and type by hand.

The list, stated rather than implied

This generator draws from a list built for the site: exactly 1024 words, so every word contributes precisely 10 bits and the sum is arithmetic you can do in your head. Six words is 60 bits, eight is 80. No word appears twice, since a duplicate would make one outcome likelier than the rest; no two words share their first four letters, so the phrase can be typed by prefix; and nothing is longer than seven letters.

It is deliberately not a copy of a published list, and the tool says so rather than borrowing someone else’s numbers.

The comparison is the argument: a list seven times larger buys a couple of bits per word, while adding one more word buys ten.

What each option is worth

The separator is free in both directions: hyphens, dots, spaces or nothing at all change how the phrase reads and not how hard it is to guess. Capitalising the first letter of every word is worth nothing either, because it is a rule the attacker applies too — one candidate in, one candidate out.

The optional trailing digit is worth log2(10), about 3.3 bits, and it is there for the fields that demand a number rather than because it helps. If you need more strength, the honest lever is the word count: one more word is worth three digits and a capital letter combined, several times over.

What sixty bits buys

Sixty bits is 2^60 candidates, with the average guess landing halfway through. Against a login form that locks after a few failures it is unreachable by an enormous margin. Against an encrypted volume on a stolen laptop, guessed at whatever rate the thief’s hardware manages, it is a serious number rather than an unassailable one — which is why eight words rather than six is the usual advice for disk encryption.

Every figure here assumes the attacker knows exactly how the phrase was built: the list, its size, the separator, the digit on the end. That is the correct assumption to make. The method is published, the word list ships with this page, and a scheme whose strength depends on nobody knowing the method has no measurable strength at all.

When this is the wrong tool

Passphrases are long, and plenty of systems still cap a password at sixteen characters, strip spaces, or reject the hyphen. Where that happens the phrase has to be truncated, which quietly discards most of the entropy the page just promised you. Check the field before relying on the number.

They are also memorable only in small quantities. One passphrase for the device you unlock every morning and one for the password manager is realistic; forty of them is not, and the accounts behind a manager are better served by long random strings you never see. Nothing generated here is transmitted or stored anywhere, so a phrase you close the tab on is gone.