Random Passphrase Generator
Strong passwords you can actually remember. This generator strings together random words (diceware-style) into a passphrase that's tough to crack but easy to recall.
How to use the Random Passphrase Generator
Three to eight words; four is a good default.
A memorable passphrase appears.
Tap Copy to use it right away.
Save it in your password manager.
About this tool
The random passphrase generator picks several unrelated words at random and joins them with separators. Long passphrases are far harder to brute-force than short complex passwords, yet much easier to remember. Everything runs locally in your browser — no passphrase ever leaves your device.
How a passphrase beats a password
A passphrase made of several random words is both easier to remember and harder to crack than a short scrambled password. The strength comes from the size of the word pool, not from added symbols. The EFF long wordlist contains 7,776 words (6&sup5;, chosen so a roll of five dice maps to one word). Each random word therefore adds about 12.9 bits of entropy (log₂7776).
- 4 words ≈ 51.7 bits
- 5 words ≈ 64.6 bits
- 6 words ≈ 77.5 bits
For comparison, a typical 8-character password drawn from upper, lower, digits and symbols (94 options) is only ~52 bits — about the same as four random words, but far harder for a human to recall. This is the idea popularised by the XKCD "correct horse battery staple" comic (#936): four common words beat one tortured password.
A worked example
Say the generator gives you maple-tractor-velvet-orbit. That is four words you can picture as a tiny scene, yet to an attacker it is one of 7,776&sup4; ≈ 3.7 trillion trillion equally likely combinations. Even at a billion guesses per second an offline attacker would average thousands of years. Add a fifth word for accounts that protect money or identity. The words are chosen with crypto.getRandomValues, so the selection is genuinely uniform — no word is favoured.
Using passphrases safely
A passphrase is only as safe as how you store it. Never reuse one across sites — breach-stuffing is the most common account-takeover route. Pair passphrases with a reputable password manager and turn on two-factor authentication where offered. The phrase is generated entirely in your browser and is never transmitted; close the tab and it is gone, so copy it into your manager before you leave.
Frequently asked questions
Why use a passphrase instead of a password?
A four-word random phrase is long and high-entropy, so it's both strong and memorable.
Is it generated securely?
Yes — it uses the browser's secure random generator and never sends data anywhere.
How many words should I use?
Four words is a solid baseline; use five or more for high-value accounts.
Can I add separators?
Words are joined with hyphens by default, which most sites accept.