Why passphrases work
A passphrase is a string of random words. It is long, which makes it strong, and made of words, which makes it easy to type and remember. The idea comes from Diceware, where people roll dice to pick words from a numbered list. This generator does the same with your browser’s secure random number generator and the EFF large word list.
Each word adds about 12.9 bits of entropy:
| Words | Entropy | Good for |
|---|---|---|
| 4 | 52 bits | Accounts with login limits |
| 5 | 65 bits | Everyday accounts and device logins |
| 6 | 78 bits | A password manager master password |
| 7 | 90 bits | Disk encryption and long-term secrets |
Fitting a site’s rules
Some sites demand a number or a symbol. Turn on “Digits at the end” or “Add a symbol” and the extra characters go after the last word, so the words stay easy to read.
Frequently asked questions
How many words should a passphrase have?
Five words for everyday accounts, six or more for a password manager master password or anything that protects encrypted data. More words is always stronger.
Is a passphrase better than a random password?
At the same entropy they are equally strong. Passphrases are easier to type and remember, while random passwords are shorter. Use passphrases for what you type by hand and random passwords for everything your password manager fills in.
Are the words really random?
Yes. Every word is drawn with crypto.getRandomValues from the 7,776-word list, using rejection sampling so each word is exactly as likely as any other.