Passphrase Generator (Diceware)
Memorable passphrases from a published word list, with the entropy stated.
Settings
Generated in your browser with the operating system’s cryptographic random source. This page is ad-free and carries a policy blocking every outbound connection, because a third-party script would run in the same document as the phrase above.
Result
CHECK54 bits — adequate, not comfortable
Fine behind a rate-limited login, thin against an offline attack on a leaked database. Six words or more is the range worth using for anything you would mind losing.
finch-cabin-button-filter-carve-crowd
- Words
- 6
- Word list size9 bits per word
- 512 words
- Entropy
- 54 bits
- Characters
- 37
- Offline guessing timeAt 100 billion guesses a second against a fast hash — a deliberately pessimistic assumption
- 1 days
What this cannot tell you
- Generated in your browser with the operating system's cryptographic random source. The phrase is never transmitted, and it is deliberately excluded from anything this page exports.
- This page is ad-free and carries a policy blocking every outbound connection. A third-party script would execute in the same document as the generated phrase.
- Entropy is calculated from the list size and the number of words, which is the only honest way to state it — and it is only valid because the words are chosen randomly. A phrase you assemble yourself from the same words has far less.
- The guessing times quoted assume an offline attack at 100 billion guesses a second against a fast hash. That is deliberately pessimistic; anything behind a proper password hash or a rate-limited login is far better off.
Take this with you
This tool never saves runs. What it handles should not be written to disk — not even your own.
How this works
Words are drawn from a published list of 512 — nine bits each — using the operating system's cryptographic random source rather than the fast, predictable generator most JavaScript uses for shuffling. The selection is rejection-sampled rather than taken modulo the list length, which removes the small bias that would otherwise make the earliest words slightly more likely and quietly cost the entropy the page claims. The list size is stated on the page because entropy is a property of the list, and a generator that will not tell you how many words it draws from is asking to be trusted about the one number that matters.
What the results mean
- Entropy in bits
- Words times 9, since the list holds 512. Six words is 54 bits, seven is 63 — each extra word is another 9 and costs a second to type.
- Word list size
- Published deliberately. A larger list gives more bits per word; a longer phrase gives more bits per phrase, and is free.
- Offline guessing time
- At a rate no ordinary attacker has, against a fast hash. Real attacks are usually slower, so the figure errs toward alarming.
- Substitutions
- Replacing letters with digits adds almost nothing — attackers have applied those rules for decades. Another word adds 9 bits.
Common problems and fixes
- The site will not accept a long passphrase
- Some still cap length or ban spaces. Use the hyphen separator and fewer, and treat the cap as information about how seriously that site takes security.
- It demands a number and a symbol
- Turn on the digit option. It adds about 3 bits, which is trivial next to the words — it exists to satisfy the rule, not to add strength.
- I cannot remember it
- Passphrases are for the handful you must type from memory: the device login and the password manager. Everything else belongs in the manager, where memorability is irrelevant.
Frequently asked questions
How many words should a passphrase have?
Six from this list is 54 bits and adequate; seven is 63 and comfortably strong against an offline attack. Below five, a passphrase stops being meaningfully better than a good password. Each additional word is worth 9 bits — far more than any amount of punctuation or letter substitution.
Are passphrases actually more secure than passwords?
For the same amount of remembering, yes, considerably. Strength comes from unpredictability, and human-chosen passwords are predictable in ways attackers model well. Randomly chosen words are unpredictable by construction and easy to hold in memory — which is the combination that makes the difference.
Is my passphrase sent anywhere?
No. It is generated in your browser and never leaves the page — which is also why this page has no adverts and a policy that blocks all outbound connections. A generator that could send your phrase somewhere is worth nothing regardless of how good its randomness is.
Put this on your own site
Free to embed, no attribution required beyond the source link the frame carries itself. It runs entirely in your visitor's browser, sets no cookies and loads no third-party script.
<iframe src="https://runthetests.com/embed/passphrase-generator/" width="100%" height="560" style="border:1px solid #e5e5e5;border-radius:8px" title="Passphrase Generator (Diceware)" loading="lazy"></iframe>
Preview it at https://runthetests.com/embed/passphrase-generator/. Embedded pages are marked noindex, so yours stays the canonical copy — not this one.