Passphrase Generator
Create secure "correct-horse-battery-staple" style passphrases.
Advertisement
Why Use a Passphrase Instead of a Password?
A passphrase is a sequence of random words used as a password. The idea, popularized by XKCD comic #936, is that "correct horse battery staple" is both easier to remember AND more secure than "Tr0ub4dor&3".
Security Comparison
- "Tr0ub4dor&3" (11 chars): ~28 bits of entropy — a single word with predictable substitutions
- 4 random words: ~44 bits — truly random selection from a large wordlist
- 5 random words: ~64 bits of entropy — current best practice minimum
- 6 random words: ~77 bits — suitable for high-security applications
- 7+ random words: ~90+ bits — considered effectively uncrackable
The Diceware Method
Diceware uses a list of 7,776 words (6⁵). Each word is selected by rolling five dice — the result maps to a word in the list. Our generator uses cryptographically secure random number generation (CSPRNG) for equivalent security without the dice.
How many words should my passphrase have?
The EFF recommends a minimum of 6 words for high-security accounts. For a password manager master password, 7–8 words is prudent. For less critical accounts with 2FA enabled, 4–5 words is more than enough. The key is that words must be chosen randomly — passphrases you compose yourself contain patterns that reduce security.
Are passphrases accepted everywhere?
Most websites accept passphrases, but some impose maximum length limits. If a site requires a number or symbol, add one at the end of your passphrase — this satisfies the requirement without destroying memorability.