Passphrase Generator

Draw a diceware-style passphrase from the real 7,776-word EFF list, with the exact entropy in bits and four crack-time rows worked out for you.

🌐 Español

🔒 Private by design: everything is generated locally in your browser and never uploaded to any server.

Written and maintained by Last updated

7,776 words, five dice rolls, and one bundled list

Diceware, described by Arnold Reinhold in 1995, is a protocol rather than a product: number a word list from 11111 to 66666, roll five dice, look up the word, repeat. The list that makes it work is exactly 7,776 words long because 6 to the fifth power is 7,776, so every possible roll maps to exactly one word and no word is more likely than any other.

This page bundles the Electronic Frontier Foundation’s long wordlist, all 7,776 of them, lowercase and picked to be distinct enough from one another to type and re-read without second-guessing. The dice are replaced by the browser’s own cryptographic random source. Each index comes from the same randomInt helper the Random Number Generator uses, which draws a 32-bit word and rejects any value that would make some indices marginally more likely than others before taking the remainder. That rejection step is the whole reason the entropy figure below is honest rather than approximately honest.

Building a six-word phrase for a password manager

  1. Set Number of words to 6. The field takes 3 to 10, and anything outside that range is pulled back to the nearest end.
  2. Leave Separator on Dash (-) unless the field you are filling dislikes dashes. Space, Dot (.) and None (glued together) are the alternatives.
  3. Change Capitalization from the default Capitalize each word to Randomly capitalize each word (adds entropy). This is the only capitalization setting that buys you anything.
  4. Leave Append a random digit ticked. It is on by default and adds one uniformly random digit as a final part.
  5. Click Passphrase Generator. The phrase, its entropy and its four crack-time rows appear together.
  6. Use Copy to clipboard to take the whole box, or Generate more to bring the options back and draw again.

Those settings report Entropy: ~86.9 bits, which is 6 words at 12.9248 bits each, plus one bit per word for the coin flip that decides capitalization, plus 3.32 bits for the digit.

Two settings add entropy, two are pure decoration

The base figure is the word count multiplied by the base-2 logarithm of 7,776, which is 12.9248 bits per word. On top of that, Randomly capitalize each word (adds entropy) flips an independent coin for every word and therefore adds exactly one bit each. Append a random digit adds the base-2 logarithm of 10, about 3.32 bits.

Nothing else counts. Capitalize each word is a fixed rule that an attacker already knows, so it contributes zero. The separator is a formatting choice, not a secret, so it contributes zero too. Plenty of generators quietly inflate their strength claim with exactly these two knobs. This one does not, which is why five words with the default settings reads 67.9 bits rather than some rounder, friendlier number.

Reading 67.9 bits across the four rows

The default five-word phrase with a digit produces this, verbatim from the box:

Online attack, rate-limited (100 guesses/hour): 324 trillion years
Online attack, no rate limit (10 guesses/second): 901 billion years
Offline attack, slow hash e.g. bcrypt (10,000 guesses/second): 901 million years
Offline attack, fast hash / GPU cracking (10 billion guesses/second): 901 years

Only the bottom row matters much. The first three describe attackers who have to talk to a login form or grind through a deliberately slow hash. The last one describes somebody who has stolen a database, found it hashed with something fast, and pointed hardware at it. That is the number to plan against, and 901 years of it is a comfortable margin. Push to ten words and three of the four rows overflow the named magnitudes entirely and fall back to scientific notation, printing values like 9.22e+33 years. The Password Strength Checker prints the same four scenarios for any password you paste, so you can compare a generated phrase against one you already use.

Three words is a floor the tool allows, not one it recommends

The minimum setting exists because clamping needs a floor, not because three words is enough. Three words, All lowercase, no digit, is 38.8 bits, and the fast-hash row for that comes back as 47 seconds. Four words with a capital on each is 51.7 bits, and that row reads 4 days. Five words is 64.6 bits before the digit, or 90.1 years against fast hashing. Six is 77.5 bits, which is 701 thousand years in the same column.

The jump between four and six words is the entire argument for diceware. Every extra word multiplies the search space by 7,776, and it costs you one more ordinary English word to remember.

Where a long phrase meets other tools’ limits

Length is not free everywhere. Hash a ten-word phrase with the Bcrypt Hash Generator & Verifier and bcrypt reads only the first 72 bytes: an 82-character phrase from this page verifies against its own first 72 characters, so the last ten do nothing at all. That is bcrypt’s documented behaviour rather than a quirk of this site, and it is a good reason not to assume more words always means more protection.

The opposite case is Encrypt a File with a Password, where the phrase is stretched through 600,000 rounds of PBKDF2 before it becomes an AES-256-GCM key. Guessing there costs a full derivation per attempt, which puts a real attacker much closer to the slow-hash row than the fast-hash one. If you want random characters instead of words, the Password Generator draws from a pool of up to 88 characters and reports its own entropy the same way. The rest of the security tools sit on the developer tools hub.

See it in action

Screenshot of the Passphrase Generator tool with Number of words set to 5, Separator set to Dash (-)
Passphrase Generator mid-process: Number of words set to 5, Separator set to Dash (-).
Screenshot of the Passphrase Generator result screen showing the generated output “Ninth-Ridden-Craftsman-Bullpen-Stature-5 Entropy…”
The finished result: the generated output “Ninth-Ridden-Craftsman-Bullpen-Stature-5 Entropy…”. The download link is a local blob URL — the file never leaves your device.

Frequently asked questions

Does the Copy button take the crack-time table along with the phrase?

Yes. The result box holds the passphrase on its first line, then a blank line, then the entropy figure and the four estimated times, and Copy to clipboard takes the lot. Paste that into a signup field and you paste the whole report with it. Click into the box and select just the first line when you want the phrase on its own.

Can the same word show up twice in one phrase?

It can. Every position is drawn independently from the full list, exactly the way rolling physical dice would behave, so nothing blocks a repeat. The odds stay small, roughly 0.13 percent for a five-word phrase and roughly 0.58 percent even at ten words. Drawing with replacement is also what keeps the entropy an exact multiple of 12.9248 bits per word instead of a messier permutation sum.

Why is the appended digit sitting behind a dash instead of stuck to the last word?

Because the digit is treated as one more part and joined with whichever separator you picked. Under the dash setting a phrase ends with a dash and then the digit; choose None (glued together) and the digit runs straight onto the final word. Entropy is identical either way, since the separator is never counted as a secret.

What happens if I clear the word count box before generating?

An empty number field reads as zero, and zero is clamped up to the minimum of three words rather than rejected. You get a three-word phrase and no warning. With All lowercase and no digit that is 38.8 bits, which the fast-hash row puts at about 47 seconds, so retype a real number before you trust the output.

Is this the genuine EFF list, and does it need crediting?

It is the complete EFF long wordlist, 7,776 lowercase English words, shipped inside this site's own code rather than pulled from eff.org when you click. The Electronic Frontier Foundation publishes it under CC BY 4.0, which makes attribution a requirement rather than a courtesy, so the credit in the article above is not decoration. Nothing about the list is secret, and knowing it does not help an attacker.

How literally should I take the years in the bottom row?

Not very. Each row divides the whole keyspace, two raised to the entropy bits, by one fixed guess rate, so it answers how long trying every possibility would take rather than how long until someone gets lucky. Using the full space instead of half of it is the more conservative of the two usual conventions. What actually happens to a real account also depends on how that service stores passwords, which this page has no way to know.

Related tools