A passphrase is several random words joined together. Each word here is drawn from a published 2,048-word list, exactly eleven bits each, so six words is 66.00 bits. The page prints that arithmetic and a crack-time at 100 billion guesses a second. You can download the list and re-run the rule that derived it from EFF's large wordlist.

Our 2,048 words are derived from EFF's 7,776-word large wordlist (CC BY 3.0 US) by a published rule you can re-run yourself. We do not use the EFF list itself: 2,048 words is exactly 11 bits per word, which is what makes the arithmetic on this page checkable by hand.

Generate a random character password instead on password generator.

This figure assumes 100 billion guesses a second, which is a fast offline attack on a fast, unsalted hash. Against a passphrase stored properly with bcrypt, scrypt or Argon2, an attacker gets far fewer guesses, so the real time is longer.

These bits assume the attacker knows this wordlist and this scheme. That is why capitalizing the words adds nothing to the figure.

The Network requests line counts the requests this page has made to other companies' servers, such as Google Analytics. None of them carries your passphrase, and how we build tools explains the few kinds of request the count can miss.

Roll five six-sided dice and read them as a base-6 number: (d1−1)×1296 + (d2−1)×216 + (d3−1)×36 + (d4−1)×6 + (d5−1) + 1. That gives a number from 1 to 7,776. If it is 2,048 or less, take that word from the list. If it is 2,049 or more, reroll all five dice. That happens about 74 times in 100. Or flip a coin 11 times instead: 2,048 is exactly 2^11, so 11 flips pick one word with no rerolls at all. 7,776 is the size of the EFF list this page does not use, and five dice address it exactly. That is why they need rerolls here and it does not.

The two numbers a passphrase needs

"Four random words" is a slogan until you know two things: how many words the list holds, and therefore how many bits each one is worth. Without both, the phrase describes a method and measures nothing.

This list holds 2,048 words, which is two to the eleventh, so every word is worth exactly 11 bits. Six words is 66 bits. Eight is 88. You can do that arithmetic yourself, which is the point of publishing it. The full list is available as the 2,048-word list, one word per line, so you can count it or import it without trusting this page.

Why 2,048 and not the 7,776 of the EFF list

The original Diceware list and the EFF long list both hold 7,776 words, which is 12.92 bits each. That is a better ratio than ours and we are not going to pretend otherwise.

What 2,048 costs in bits it returns in checkability. Drawing fairly from 7,776 requires rejection sampling to avoid modulo bias, and getting that wrong produces a generator that is very slightly predictable in a way nobody will ever notice. At 2,048 the entropy is a whole number and the arithmetic on this page is checkable rather than taken on trust. BIP-39, the Bitcoin proposal that defines mnemonic wallet phrases, uses a 2,048-word list too: it splits random bits, plus a short checksum, into groups of 11 and turns each group into one word, so every word stands for exactly 11 bits.

That is the whole trade: 11 bits a word exactly, so six words is 66.00 bits with no leftover fraction, and you can check every bit count on this page with one multiplication.

Which parts add nothing

Capitalizing the first letter of each word adds no entropy at all. Neither does the choice of separator. An attacker who knows a passphrase came from a generator knows the pattern, and the pattern is not the secret. Both are formatting, and the number on screen does not count them.

A trailing digit adds log2(10), which is 3.32 bits. It is here because some password fields still refuse anything without a number, not because it helps. One more word is worth more than three of them.

That is why this page says so plainly. A generator that offers those toggles and lets the strength meter jump when you tick them is telling you something false about your own password.

How the list was built

Words are four to six letters, so a passphrase stays typeable on a phone keyboard. They are spellable from hearing them, because a passphrase gets read aloud and written down. The selection rule is published at published word-list selection rule: keep that length band, keep the alphabetically-first word of each group sharing its first four letters, sort, and take the first 2,048. Anyone can re-run it against EFF's file and diff the result against ours.

Before any update to this page goes live, an automated check confirms the list holds exactly 2,048 words, with no repeats, each four to six letters long and all plain lowercase. A list that fails any of those checks never goes live, because at 2,047 words every entropy figure here would be quietly wrong.

How to learn one without weakening it

Keep the generated words exactly as drawn. Read the phrase aloud, split it into two short groups, then type it from memory a few times with the output still available to check. Come back after a few minutes and type it again. The repetition builds recall; changing a difficult word to a favorite word quietly changes the random process.

For the one passphrase that unlocks a password manager, keep a paper recovery copy in a place you would protect like a passport. Do not store that copy in the same password manager it unlocks. For ordinary accounts, use the password generator instead and let the manager remember the result.

Questions

How many words should a passphrase have?

Six is a good default. Each word comes from a 2,048-word list, so it adds exactly 11 bits. Six words is 66 bits: 12 years on average at 100 billion guesses a second. Four words is 44 bits, or about 90 seconds on average. For a master passphrase, use seven or eight.

What makes a good passphrase?

One that a random draw picked. Keep the words exactly as drawn. Swapping one for a favorite changes the process and weakens it. Don't reuse a phrase you've seen printed as an example. Once it's in print, it's no longer a secret. Words here are 4 to 6 letters long, so six words with hyphens run 29 to 41 characters.

Can I use dice, like Diceware?

Yes, with rerolls. Roll five dice to get a number from 1 to 7,776. Take that word if it's 2,048 or lower, and reroll all five if it's higher. That happens about 74 times in 100. Or flip a coin 11 times, which picks one word with no rerolls. Download the list to use it offline.

Does capitalizing or adding a number make it stronger?

Capitalizing adds nothing. Neither does the separator. An attacker who knows the scheme tries both. A trailing digit adds 3.32 bits, so six words plus a digit is 69.32 bits. It's there for sites that insist on a number. One more word adds 11 bits, which beats three digits.

Does using common words make it weaker?

No, as long as the draw is random. The strength comes from how many combinations there are, not from rare words. Six words from 2,048 give 73,786,976,294,838,206,464 possible phrases. That count assumes the attacker has this exact list, and you should assume they do.

Is the passphrase generated here or on a server?

Here, in this tab, from the browser's secure random source. The passphrase is not sent and not kept. You can confirm it with a network tab open. Before any update to this page goes live, an automated check types into every box and presses every button, and blocks the update if what it typed turns up in a request.

Related tools

For a secret a password manager will type for you, the password generator is the better tool because length costs nothing. To measure something you already use, the password strength checker estimates it and shows its working. Generating either in a browser tab is the subject of is it safe to use an online password generator. Both sit next to the rest of the developer tools.

Passphrase generator

Generate a passphrase