Passphrase Generator

What this tool is used for

• Producing a credential you actually have to type or dictate, where length beats symbol soup.
• Generating a passphrase for a disk or a key file that must be memorised.
• Producing a strong value for a WiFi network that people will enter by hand.
• Creating a recovery phrase that can be written down legibly.
• Generating a credential for someone who will type it on a phone keyboard.

Frequently Asked Questions

Why are passphrases stronger than passwords?

Because length beats complexity against modern cracking. Six random Diceware words carry ~77 bits of entropy and are memorable; an 8-character password with symbols carries ~52 bits and is not. The words must be RANDOM — a chosen phrase has far less entropy than it appears.

What is Diceware?

A method using physical dice to select words from a numbered list of 7,776 (6^5), so each word contributes exactly log2(7776) ≈ 12.9 bits. The list is public — the security comes entirely from the randomness of the selection, not from secrecy.

How many words do I need?

Six for ~77 bits, which resists offline cracking today; seven or eight for high-value secrets like a master password or disk encryption key. Four words (~51 bits) is no longer sufficient against a determined offline attacker.

Does adding numbers and symbols help?

Marginally, and it usually costs more memorability than it buys entropy. Adding one random word adds ~12.9 bits; appending '1!' adds almost nothing because attackers try exactly those patterns first.

Is the famous xkcd advice still valid?

The principle holds — length and randomness beat obscure substitution — but the numbers have aged. The comic's four-word example was sized for 2011 hardware; six words is the modern equivalent of that security level.

Does the separator matter?

Only for usability, not entropy — the strength is in the number of words and the size of the list. A separator helps a human parse the phrase and stops two words merging into an unintended third.

Should I use a passphrase everywhere?

No — use a password manager for site logins, where length and typing effort are wasted. Passphrases earn their keep where something must be typed and memorised: the manager's own master password, disk encryption, an SSH key.

Is a memorable sentence as good as random words?

No. A phrase you compose follows grammar and your own vocabulary, which cuts the search space enormously — attacks build on exactly that. The unpredictability has to come from the selection, not from the person.

Common errors and gotchas

• Choosing too few words, where the strength comes from the count and the list size together.
• Picking the words yourself, which collapses the entropy the random selection provided.
• Assuming a passphrase is weak because it contains no symbols, when length dominates.
• Adding a predictable number or capital to satisfy a policy and thinking it added real strength.
• Reusing a memorable passphrase across sites because it is easy to remember.