A passphrase is several random words joined together. Each word here is drawn from a published 2,048-word list, exactly eleven bits each, so six words is 66.00 bits. The page prints that arithmetic and a crack-time at 100 billion guesses a second. You can download the list and re-run the rule that derived it from EFF's large wordlist.

Our 2,048 words are derived from EFF's 7,776-word large wordlist (CC BY 3.0 US) by a published rule you can re-run yourself. We do not use the EFF list itself: 2,048 words is exactly 11 bits per word, which is what makes the arithmetic on this page checkable by hand.

Generate a random character password instead on /dev/password-generator.

This figure assumes 100 billion guesses a second, which is a fast offline attack on a fast, unsalted hash. Against a passphrase stored properly - bcrypt, scrypt or Argon2 - an attacker gets far fewer, so the real time is longer.

These bits assume the attacker knows this wordlist and this scheme. That is why capitalizing the words adds nothing to the figure.

This page loads nothing from anyone else today. That changes when we start serving ads, and we will say so here when it does.

Roll five six-sided dice and read them as a base-6 number: (d1−1)×1296 + (d2−1)×216 + (d3−1)×36 + (d4−1)×6 + (d5−1) + 1. That gives a number from 1 to 7,776. If it is 2,048 or less, take that word from the list. If it is 2,049 or more, reroll all five dice - which happens about 74 times in 100. Or flip a coin 11 times instead: 2,048 is exactly 2^11, so 11 flips pick one word with no rerolls at all. 7,776 is the size of the EFF list this page does not use, and five dice address it exactly - which is why they need rerolls here and it does not.

The two numbers everyone else leaves out

"Four random words" is a slogan until you know two things: how many words the list holds, and therefore how many bits each one is worth. Without both, the phrase describes a method and measures nothing.

This list holds 2,048 words, which is two to the eleventh, so every word is worth exactly 11 bits. Six words is 66 bits. Eight is 88. You can do that arithmetic yourself, which is the point of publishing it. The full list is at /dev/wordlist-2048.txt, one word per line, so you can count it or import it without trusting this page.

Why 2,048 and not the 7,776 of the EFF list

The original Diceware list and the EFF long list both hold 7,776 words, which is 12.92 bits each. That is a better ratio than ours and we are not going to pretend otherwise.

What 2,048 costs in bits it returns in checkability. Drawing fairly from 7,776 requires rejection sampling to avoid modulo bias, and getting that wrong produces a generator that is very slightly predictable in a way nobody will ever notice. At 2,048 the entropy is a whole number and the arithmetic on this page is checkable rather than taken on trust. It is the same size, for the same reason, that BIP-39 uses.

The page used to cite a JavaScript budget as the reason for the smaller list. The reason that survives inspection is the one above: 11 bits exactly, so six words is 66.00 bits with no leftover fraction to hide a hard-coded digit bonus behind.

Which parts add nothing

Capitalizing the first letter of each word adds no entropy at all. Neither does the choice of separator. An attacker who knows a passphrase came from a generator knows the pattern, and the pattern is not the secret. Both are formatting, and the number on screen does not count them.

A trailing digit adds log2(10), which is 3.32 bits. It is here because some password fields still refuse anything without a number, not because it helps. One more word is worth more than three of them.

Being explicit about this is the whole differentiator. A generator that offers those toggles and lets the strength meter jump when you tick them is telling you something false about your own password.

How the list was built

Words are four to six letters, so a passphrase stays typeable on a phone keyboard. They are spellable from hearing them, because a passphrase gets read aloud and written down. The selection rule is published at /dev/wordlist-2048-rule.txt: keep that length band, keep the alphabetically-first word of each group sharing its first four letters, sort, and take the first 2,048. Anyone can re-run it against EFF's file and diff the result against ours.

The build fails if that file ever holds a number of words other than 2,048, because at 2,047 every entropy figure here would be quietly wrong. The same check fails the build on a repeated word, on anything outside four to six letters, and on anything that is not plain lowercase, since those are the other three things this page claims about the list.

How to learn one without weakening it

Keep the generated words exactly as drawn. Read the phrase aloud, split it into two short groups, then type it from memory a few times with the output still available to check. Come back after a few minutes and type it again. The repetition builds recall; changing a difficult word to a favorite word quietly changes the random process.

For the one passphrase that unlocks a password manager, keep a paper recovery copy in a place you would protect like a passport. Do not store that copy in the same password manager it unlocks. For ordinary accounts, use the password generator instead and let the manager remember the result.

Questions

Is there a keyboard shortcut?

Control+Enter on Windows and Linux, or Command+Enter on a Mac, generates a new passphrase when focus is inside the tool. Space is left alone so it still scrolls the page.

How many words do I actually need?

Six, at 66 bits, is beyond any realistic offline attack on a properly stored password and is comfortable to type. Seven or eight is the right answer for something protecting everything else, such as a password manager's master passphrase or a disk encryption key. Four, at 44 bits, is not enough on its own against an attacker with a stolen database.

Does using common words make it weaker?

No, as long as the choice was random and the list is public. The security comes from the number of possible combinations, not from the obscurity of the words. Six words from 2,048 is about 74 quintillion possibilities, and that figure assumes the attacker has our exact list in front of them, which they should be assumed to have.

Can I use the one from the famous comic?

Not that one specifically, no. It has been in every cracking wordlist for over a decade. The method is sound and that particular output is spent, which is a neat illustration of the real rule: the entropy is in the process that produced the phrase, not in the words themselves.

Is the passphrase generated here or on a server?

Here, in this tab, drawn from the browser's cryptographic random source. Nothing is transmitted and nothing is kept. You can confirm it with a network tab open, and a build-time test fails the release if this page ever makes a request.

Should I write it down?

For a master passphrase, yes, on paper, kept somewhere you would keep a passport. The threat model for the one passphrase that unlocks everything else is forgetting it, not a burglar. For everything else, let a password manager hold a random password instead and never see it at all.

Related tools

For a secret a password manager will type for you, the password generator is the better tool because length costs nothing. To measure something you already use, the password strength checker estimates it and shows its working. Generating either in a browser tab is the subject of is it safe to use an online password generator. Both sit next to the rest of the developer tools.

Passphrase generator

Generate a passphrase