Passphrase generator · EFF wordlist
Passphrase Generator
A memorable password generator built on the EFF large wordlist. Random words, easy to remember and type, strong enough for your master password.
Loading the EFF wordlist…
Generated in your browser with crypto.getRandomValues(). Nothing is sent or stored. Verify it
What Is a Passphrase?
A passphrase is a password made of several random words, like relic-uncover-mango-shrug-dawn-petal. It is long, so it is hard to brute-force, but it is made of real words, so it is easy to remember and easy to type on a phone or TV remote.
The security of a passphrase comes entirely from the words being picked at random by a machine, not by you. A phrase you invent - a song lyric, a quote, "ilovemydog" - follows the patterns of language and is exactly what cracking dictionaries are built from. Six words drawn uniformly from a 7,776-word list give about 77.5 bits of entropy no matter which words come up, because the attacker has to consider every combination.
That makes this a good word password generator for the handful of secrets you genuinely have to remember: the master password of your password manager, your computer login, your phone's alphanumeric passcode, full-disk encryption. For everything else, store a random password in the manager.
The EFF Wordlist and the Word-Count Ladder
This generator uses the EFF large wordlist - 7,776 words published by the Electronic Frontier Foundation in 2016 specifically for passphrases (licensed CC BY 3.0 US). The list was built to fix problems with older Diceware lists: every word is a common, concrete English word, there are no offensive or hard-to-spell words, and no word is a prefix of another, so words can be joined without a separator and still be read back unambiguously. The list is shipped from our own server and checked on load, so generating never contacts a third party.
Each word is chosen with crypto.getRandomValues() and rejection sampling, so all 7,776 words are equally likely. That gives exactly log2(7776) ≈ 12.925 bits per word. Pick your word count from the ladder:
| Words | Entropy (bits) | Avg crack time, GPU rig | Avg crack time, huge cluster | Same strength as |
|---|---|---|---|---|
| 3 words | 38.8 | 2.4 seconds | less than a second | ≈ 6 random chars |
| 4 words | 51.7 | 5.1 hours | 30 minutes | ≈ 8 random chars |
| 5 words | 64.6 | 4.5 years | 165 days | ≈ 10 random chars |
| 6 words | 77.5 | 35 thousand years | 3.5 thousand years | ≈ 12 random chars |
| 7 words | 90.5 | 272 million years | 27 million years | ≈ 14 random chars |
| 8 words | 103.4 | 2.1 trillion years | 212 billion years | ≈ 16 random chars |
| 10 words | 129.2 | 10²⁰ years | 10¹⁹ years | ≈ 20 random chars |
Crack times assume an offline attacker guessing 100 billion (GPU rig) or 1 trillion (massive cluster) passphrases per second against a leaked fast hash - the worst realistic case. "Same strength as" is the length of a fully random password using upper, lower, digits and symbols. Our recommendation: 6 words for a password manager master password, 5 for accounts protected by 2FA, 7+ for encryption keys that may face offline attacks for decades.
Capitalizing words does not add entropy (it is a fixed rule the attacker can assume), but it satisfies sites that demand uppercase. "Add a number" inserts one random digit after one random word, adding log2(10 × words) bits; the "random digit" separator adds about 3.3 bits per gap. The readout above accounts for all of it.
Passphrase vs Password: Which Should You Use?
| 6-word passphrase | 16-char random password | |
|---|---|---|
| Example | enjoyment-papyrus-expedited-humility-consoling-cacti | q7#Vt2mX!pR9eZ4k |
| Entropy | ~77.5 bits | ~104.6 bits |
| Easy to remember | Yes, with a little practice | No |
| Easy to type on mobile | Yes (lowercase only) | No (symbol keyboards) |
| Best for | Master password, device login, encryption | Everything stored in a password manager |
A random password packs more entropy per character; a passphrase packs more entropy per thing-you-have-to-remember. Some old systems cap passwords at 16 or 20 characters or forbid spaces - in that case use the random password generator, or a 4-word passphrase with no separator. To see how a specific phrase measures up, paste it into the password strength checker.
Generate a Password From Your Own Words
Many people want a password built from words they chose - a pet, a city, a hobby. The catch is that such words are exactly what an attacker tries first: they are on your social media, in your email and in every targeted guess list. So the generator below mixes your words with random words from the EFF list, in a random order, and is honest about where the strength comes from.
- Your words count as 0 bits. The calculation assumes the attacker knows them.
- Each random word adds 12.9 bits, exactly as in the main generator.
- The random order adds a little - with two words of yours and five random words, 5.4 bits for where your words land. It counts only when your words are different from each other, letters only and not in the EFF list; otherwise two orders could produce the same phrase, and counting them would overstate the result.
Two words of yours plus five random words come to 70.0 bits in total - only 5.4 bits more than the five random words alone (64.6 bits), because nearly all of it is the random part. Your words make the phrase easier to remember, not harder to guess. The words you type stay in this tab: they are not put in the address, stored or sent.
Type your words below.
Your words are treated as known to an attacker: names, pets, places and hobbies are easy to find out, so they add no strength. All of the strength comes from the random words and the random order.
Diceware and the xkcd Password Method
The idea goes back to Diceware, published by Arnold Reinhold in 1995: roll five six-sided dice, look up the resulting five-digit number in a list of 65 = 7,776 words, repeat for each word. The EFF large list keeps the same 7,776-word size, so you can use it with physical dice if you want randomness you can literally see. This page does the same thing with your device's cryptographic random number generator instead of dice.
The method became famous through xkcd comic #936, "Password Strength", which compared Tr0ub4dor&3 (a dictionary word with predictable substitutions, estimated at ~28 bits) with correct horse battery staple (four random common words, ~44 bits from a 2,048-word list). The comic's point holds: random words beat clever-looking substitutions. Its numbers were for an online attack, though. Against a leaked hash on modern hardware, four words is no longer enough - which is why an xkcd password generator today should default to five or six words from a larger list, as this one does.
Two rules make the method work, and both are easy to break by accident: the words must be chosen randomly (regenerating a few times is fine; cherry-picking individual words from many results is not), and the phrase must be unique to one account.
Passphrase Examples
Real output of this generator with different settings, so you can see what each option does. Do not use these - they are published on this page, so they are in every attacker's list now. Generate your own above.
| Settings | Example | Entropy |
|---|---|---|
| 6 words, hyphen | enjoyment-papyrus-expedited-humility-consoling-cacti | ~77.5 bits |
| 5 words, space | paternity ought anaconda bullring catsup | ~64.6 bits |
| 6 words, dot, capitalized | Shortlist.Estranged.Overrun.Erratic.Sliding.Unquote | ~77.5 bits |
| 5 words, random digit separator | landside6relive3implode0premium2serrated | ~77.9 bits |
| 6 words, hyphen, add a number | grew-hypocrite-grievous2-excuse-gutter-endpoint | ~83.5 bits |
Memorable, Funny and Pronounceable Passwords
People look for an easy to remember password generator, a pronounceable password generator or even a funny password generator - they all want the same thing: a strong password a human can hold in their head. Random words are the honest way to get there. They are pronounceable by construction, and random combinations are often absurd enough to be funny, which is exactly what makes them stick.
To memorise a new passphrase:
- Build a picture. "cradle snowcap unify oxidize jersey plank" becomes a baby's cradle on a snowy peak, rusting, wearing a football jersey, balanced on a plank. Silly images are easier to recall.
- Repeat it. Type it from memory a few times on the day you create it, then once a day for a week. Spaced repetition does the rest.
- Keep a backup in a safe physical place until it has stuck - especially for a master password that cannot be reset.
What not to do: don't swap words for ones you like better, don't add your birthday, and don't reuse the phrase anywhere else.
Passphrase Generator FAQs
How many words should a passphrase have?
Six words from the EFF large wordlist (~77.5 bits) is a strong default for a master password. Five words (~64.6 bits) is fine for accounts with two-factor authentication. Use seven or more for encryption keys or anything that could be attacked offline for years.
Which wordlist does this passphrase generator use?
The EFF large wordlist: 7,776 common English words published by the Electronic Frontier Foundation for passphrase generation. It is served from our own domain and checked before any word is picked: exactly 7,776 unique words, none of them a prefix of another.
Are passphrases more secure than passwords?
Per character, no - a random password is denser. Per thing-you-must-remember, yes. A six-word passphrase is about as strong as a 12-character random password and much easier to recall and type.
Does adding capitals, numbers or symbols make a passphrase stronger?
Capitalizing every word adds no real entropy, because an attacker will simply try that rule. A randomly placed digit adds a few bits (about 5.9 for six words), and the readout shows exactly how many. Adding one more word (+12.9 bits) is almost always the better trade. The hyphen, dot and underscore separators already count as symbols on sites that demand one.
Is it safe to generate a passphrase online?
Here, yes: the words are picked in your browser with crypto.getRandomValues(), and the page makes no network request after the wordlist loads. You can go offline and keep generating. See how to verify it.
Can I use this as a Diceware generator?
Yes. The EFF large list is a Diceware-compatible 7,776-word list, so a passphrase from this page has the same strength as one rolled with five dice per word. If you prefer physical dice, the method works with the same list.
What is the xkcd password method?
It is the "correct horse battery staple" approach from xkcd comic #936: pick several random common words instead of one word with clever substitutions. The idea is sound; today you should use more words (five or six) from a bigger list than the comic assumed.
Can I pick my own words?
You can, but human-chosen words are far more predictable than random ones, and the entropy numbers on this page would no longer apply. If you want a passphrase based on words you chose, check it with the password strength checker instead.
Why are the words separated by hyphens by default?
Hyphens are accepted almost everywhere and are easier to see than spaces; some sites strip or reject spaces. The separator does not change strength (except "random digit", which adds about 3.3 bits per gap), so pick whatever the site accepts.
Related tools