Loading Passphrase Generator…
6 × 10 bits a word
A separator adds no entropy. It exists so the words stay readable and so a field that rejects spaces still accepts the result.
The list is 1024 words, so each word is exactly 10 bits. That figure is the whole claim: it holds only because the words are chosen by the machine, uniformly, with repeats allowed. Pick the words yourself and the arithmetic collapses, because people reach for the same few hundred nouns and pick them in an order that makes a sentence. No word appears twice in the list, no two words share their first four letters, and none is longer than seven letters.
Capitalising the first letter of every word adds nothing to the sum above. It is a rule, not a choice, so an attacker applies the same rule — one candidate becomes one candidate. The same goes for putting the digit at the end rather than somewhere unpredictable: the tool counts it as 3.3 bits, which is what ten known options are worth.
The method is Arnold Reinhold’s, published in 1995 as Diceware: number a list of words, roll physical dice to pick them, and the strength of the result is arithmetic rather than opinion. This tool replaces the dice with the browser’s cryptographic random number generator and keeps everything else, including the part people skip — the machine picks the words, and picking them yourself invalidates the whole calculation.
The reason is that human choices cluster. Left to ourselves we reach for the same few hundred nouns and arrange them into something that reads like a sentence, which is a far smaller set than the list makes available and a set an attacker can enumerate. A phrase that sounds random and a phrase that is random look identical on the page and differ by many orders of magnitude underneath.
This generator draws from a list built for the site: exactly 1024 words, so every word contributes precisely 10 bits and the sum is arithmetic you can do in your head. Six words is 60 bits, eight is 80. No word appears twice, since a duplicate would make one outcome likelier than the rest; no two words share their first four letters, so the phrase can be typed by prefix; and nothing is longer than seven letters.
It is deliberately not a copy of a published list, and the tool says so rather than borrowing someone else’s numbers. For comparison, the Electronic Frontier Foundation’s long list holds 7776 words at about 12.9 bits each, and the BIP-39 English list used by cryptocurrency wallets holds 2048 at 11 bits. A larger list buys a couple of bits per word; adding one more word buys ten.
The separator is free in both directions: hyphens, dots, spaces or nothing at all change how the phrase reads and not how hard it is to guess. Capitalising the first letter of every word is worth nothing either, because it is a rule the attacker applies too — one candidate in, one candidate out.
The optional trailing digit is worth log2(10), about 3.3 bits, and it is there for the fields that demand a number rather than because it helps. If you need more strength, the honest lever is the word count: one more word is worth three digits and a capital letter combined, several times over.
Sixty bits is 2^60 candidates, with the average guess landing halfway through. Against a login form that locks after a few failures it is unreachable by an enormous margin. Against an encrypted volume on a stolen laptop, guessed at whatever rate the thief’s hardware manages, it is a serious number rather than an unassailable one — which is why eight words rather than six is the usual advice for disk encryption.
The figure assumes the attacker knows exactly how the phrase was built: the list, its size, the separator, the digit on the end. That is the correct assumption to make. The method is published, the word list ships with this page, and a scheme whose strength depends on nobody knowing the method has no measurable strength at all.
Passphrases are long, and plenty of systems still cap a password at sixteen characters, strip spaces, or reject the hyphen. Where that happens the phrase has to be truncated, which quietly discards most of the entropy the page just promised you. Check the field before relying on the number.
They are also memorable only in small quantities. One passphrase for the device you unlock every morning and one for the password manager is realistic; forty of them is not, and the accounts behind a manager are better served by long random strings you never see. Nothing generated here is transmitted or stored anywhere, so a phrase you close the tab on is gone.
Six is a sound default at 60 bits and suits an account behind a rate limit. Seven or eight is the sensible range for a password manager or full-disk encryption, where an attacker can guess offline as fast as their hardware allows.
No. Every draw is independent, so a repeat is a legitimate outcome and rerolling it would make the remaining words slightly likelier, costing a fraction of the entropy the count above claims. Press generate again only if you dislike the phrase.
Not in this tool, and the omission is deliberate. Substituting words you chose breaks the assumption every figure here rests on, which is that each position was drawn uniformly from a list of known size.
Usually, and that is much of the point: whole words are far easier to read off a screen and enter on a phone or a television remote than sixteen mixed symbols. The trade is length, which some input fields will not accept.