Passphrase generator

About this tool

A randomly generated passphrase is one of the few things in password security you can measure exactly. If a machine picks k words uniformly at random from a list of n, there are n^k possible results and no amount of cleverness on the attacker's part changes that number. Human-chosen passwords have no such guarantee — estimating their strength was, in the words of the EFF wordlist's author, the subject of an entire PhD thesis and remains an open research area.

That is the whole argument for generating rather than inventing. This page picks the words for you so the maths holds.

How it works

Words come from the EFF short wordlist: 1,296 words (6⁴, so it can be rolled with four dice), every word five characters or fewer, no word an exact prefix of another, homophones and hard-to-spell words removed. Each word contributes log₂(1296) = 10.34 bits.

Randomness comes from crypto.getRandomValues, not Math.random. To turn a random 32-bit integer into a number from 0 to 1,295 without bias, values in the final partial block are discarded and redrawn — taking the remainder directly would make the first 1,296 words very slightly more likely than the rest. The bias is small; discarding is free; there is no reason to accept it.

The entropy table is calculated from what the generator actually randomises, not from the finished string. Choosing "first letter of each word" adds zero bits, because it is a fixed transformation an attacker can apply too. Choosing "random per word" adds one bit per word, because each word genuinely flips a coin.

Common questions

Why the short wordlist and not EFF's long one?

The long list has 7,776 words at 12.9 bits each; the short list has 1,296 at 10.34 bits each. The short list needs more words for the same strength, but every word is five characters or fewer, so the passphrase is usually shorter to type. Eight short words give 82.7 bits — more than six long words, which give 77.5. If you would rather use the long list, EFF publishes it as a plain text file and the maths is identical with 12.9 substituted for 10.34.

Does adding a digit and a symbol help much?

Barely. Look at the table above: a random digit inserted at a random position in an eight-word passphrase adds roughly 6 bits. One more word adds 10.34. The digit and symbol options exist because some password fields still refuse to accept anything without them, not because they are a good way to buy strength.

Can I trust a passphrase generated on a web page?

Only as much as you trust the page. This one runs entirely in your browser with no network access after load, and you can read the source — it is a single unminified file. But that is a claim you are taking on trust unless you check it. For anything critical, generate offline with real dice and EFF's published list, or use a password manager's built-in generator.

Should I memorise this or put it in a password manager?

Almost everything belongs in a password manager. Passphrases are worth memorising for the handful of secrets that unlock everything else — the password manager's own master password, a disk encryption key, an SSH key passphrase — because those are the ones you have to type before any manager is available.

Known limitations

• Short wordlist onlyThe EFF long list (7,776 words) is not embedded. The short list was chosen because it could be verified complete, and because five-character words keep the result typeable. This is a deliberate trade-off, not an oversight.
• English onlyEvery word is English. A passphrase from a wordlist in a language you actually speak is easier to remember, and the entropy maths is unchanged — but no other wordlist is included here.
• The entropy figure assumes the generator, not the humanEvery bit claimed above depends on the words being machine-picked and kept. If you generate ten passphrases and pick the one that reads nicest, you have introduced human choice and the number is no longer exactly right.
• One word contains a hyphenEFF's list includes yo-yo, and the list is reproduced unmodified rather than quietly edited. With the hyphen separator selected, a passphrase containing that word reads as though it has one more word than it does. The strength is unaffected — the word was still one pick from 1,296 — but if the word count matters to you, pick a different separator.
• No storageNothing generated here is saved, in local storage or anywhere else. Reload the page and it is gone. Copy what you want before you leave.

The same job at the command line

• shuf -n 8 --random-source=/dev/urandom eff_short_wordlist_1.txt | cut -f2 | paste -sd-Picks eight words from EFF's published list using the kernel's random source. Download the list from eff.org first.
• openssl rand -base64 32A random string rather than a passphrase — fine for anything you will never type by hand, useless for anything you have to memorise.
• pwgen -s 20 1Random character strings from the pwgen package, with -s for genuinely secure rather than pronounceable output.

Credits

The wordlist is EFF's short wordlist (1,296 words), published by the Electronic Frontier Foundation and licensed CC BY 3.0 US. Source: EFF's New Wordlists for Random Passphrases. The list is reproduced here unmodified.