Passphrase generator

A passphrase is a password made of several random words. It is far easier to remember than a jumble of symbols and, chosen properly, much harder to crack. This generator builds one for you locally, drawing words at random from the EFF wordlist with your browser’s cryptographic RNG. Nothing is ever sent to a server.

What is a diceware passphrase?

Diceware is a method for picking words at random from a numbered list — traditionally with physical dice, here with crypto.getRandomValues(). Because each word is chosen independently and uniformly, the strength of the result is easy to calculate and doesn’t depend on human “cleverness”, which is usually where passwords go wrong.

Why passphrases beat “complex” passwords

Rules like “8 characters, one capital, one symbol” push people toward predictable patterns — Password1!, Summer2025 — that crackers try first. A five- or six-word passphrase carries more entropy than a typical complex password while staying typeable and memorable. Length beats complexity.

How much entropy do you need?

Entropy is measured in bits; each extra bit doubles the guesses an attacker must make. Using a ~1,296-word list (about 10.3 bits per word):

How this generator works

Words are selected with crypto.getRandomValues() — the browser’s cryptographically secure RNG, not the predictable Math.random(). The wordlist ships with the page. Everything runs client-side: your passphrase is generated on your machine and never transmitted, logged, or stored. Load the page, go offline, and it still works.

Using your passphrase safely

• Use a unique passphrase per account — a password manager makes this painless.
• Reserve your longest hand-typed passphrase for the manager’s master password and for full-disk encryption.
• Turn on two-factor authentication wherever it’s offered.
• Don’t “improve” the output by editing it — that usually reduces entropy.