How to use the passphrase generator
- Choose how many words you want in your passphrase (at least 4).
- Pick a separator such as a space, hyphen or dot.
- Optionally enable capitalization for easier reading.
- Click Generate to roll the dice and build your phrase.
- Copy the result along with its entropy value.
How entropy is calculated
The EFF large wordlist contains exactly 7776 words, which is 65. That means each word represents five rolls of a six-sided die. The information content per word is log2(7776), which equals approximately 12.9248 bits.
To find the total entropy, multiply the number of words by that constant. For example, a four-word passphrase has 4 x 12.9248 = 51.70 bits of entropy. A six-word phrase reaches 77.55 bits. Because every selection uses crypto.getRandomValues, each word is chosen uniformly at random from all 7776 options, ensuring the theoretical entropy matches reality. This passphrase generator performs that math instantly so you know exactly how strong your result is.
The EFF large wordlist
The Electronic Frontier Foundation published the large wordlist in 2016 to improve on earlier diceware lists. Its words are 3 to 9 characters long (about 7 on average) and were chosen by EFF to be familiar and easy to type. Four entries, drop-down, felt-tip, t-shirt and yo-yo, contain a hyphen of their own.
Every word maps to a unique five-dice roll from 11111 to 66666. This one-to-one mapping is what makes it a proper diceware generator: you can replicate the process with physical dice if you prefer. The list is released by EFF under a Creative Commons Attribution 3.0 US license; the word list is credited to the Electronic Frontier Foundation (eff.org/dice).
Why passphrases beat passwords
A common eight-character password using upper case, lower case, digits and symbols draws from roughly 95 possible characters. Its maximum entropy is 8 x log2(95) = 52.6 bits, but only if every character is truly random. In practice, people use patterns like "P@ssw0rd", dropping real entropy far below the theoretical maximum.
A four-word passphrase from this tool provides 51.7 bits of genuine randomness with no pattern to exploit. Adding two more words pushes it past 77 bits, comparable to a random 12-character password drawn from all 95 printable characters (about 78.8 bits) while remaining something a person can actually remember. This is the core insight behind the famous "correct horse battery staple" comic that popularized the concept.
Recommended entropy levels
| Words | Entropy (bits) | Suitable for |
|---|---|---|
| 4 | 51.70 | Low-risk accounts, local device unlock |
| 5 | 64.62 | Email, social media, general web use |
| 6 | 77.55 | Password managers, financial accounts |
| 7 | 90.47 | High-security systems, encryption keys |
| 8 | 103.40 | Long-term archival encryption |
The suitability column is general guidance, not a guarantee. A common rule of thumb is to aim for 80 bits or more for sensitive accounts, which means seven words from this list. If you need a shorter numeric secret instead, consider a passcode generator for PIN-based systems.
Using your passphrase safely
Once generated, treat the passphrase like any other credential. Do not reuse it across multiple sites. Store it in a password manager rather than writing it on paper unless you keep that paper physically secure.
If a service limits password length, check whether your phrase fits before submitting it. Six words separated by spaces typically produce around 45 characters, well within the limits of most modern platforms. For services that forbid spaces, switch the separator to a hyphen or dot. Using a dedicated passphrase generator ensures you never fall back on weak, reused credentials.
Worked examples
| Example | Input | Result |
|---|---|---|
| Classic four-word phrase | Number of words: 4; Separator: space; Capitalize each word: no | Passphrase: surpass uneasy unhidden dumping; Words: 4; Entropy: 51.7 bits; Character count: 31 |
| Six words with hyphens | Number of words: 6; Separator: hyphen; Capitalize each word: yes | Passphrase: Saucy-Floss-Unfitting-Pasta-Tying-Prudishly; Words: 6; Entropy: 77.55 bits; Character count: 43 |
| Five words, no separator | Number of words: 5; Separator: none; Capitalize each word: no | Passphrase: capsizedefraudrefutabletrapdoorspecks; Words: 5; Entropy: 64.62 bits; Character count: 37 |
FAQ
What is a diceware generator?
A diceware generator selects words by simulating rolls of six-sided dice. Each five-dice combination maps to one word in a list of 7776 entries, guaranteeing uniform randomness.
Why is it called correct horse battery staple?
That phrase comes from a 2011 webcomic illustrating that four random common words are harder for computers to crack than short complex passwords, yet easier for humans to remember.
How many words should my passphrase have?
Four words provide about 52 bits of entropy, suitable for casual accounts. Use six or more words for banking, email or password managers to reach 77 bits or more.
Is this an xkcd password generator?
Yes, it follows the exact method shown in the xkcd comic: pick random words from a large list and string them together. The math behind it is standard diceware.
Are the words sent to a server?
No. The entire wordlist is embedded in the page and selections happen locally via your browser's cryptographic random number generator. Nothing leaves your device.
Can I use physical dice instead?
Absolutely. Roll five dice, read the numbers as a five-digit sequence from 11111 to 66666, and look up the corresponding word in the EFF large wordlist.
Should I add numbers or symbols to my passphrase?
Adding a random digit or symbol increases entropy slightly, but simply adding another word from the list is more effective and keeps the phrase easy to type.