Passphrase generator
Random words drawn from the EFF's 7,776-word list, generated privately on your device. Easy to remember, hard to crack.
Generated on your device with your browser's secure random number generator. The generator can't make network requests.
Why passphrases work
A passphrase like tinsel-gravity-unclamped-swoop-mosaic-yarn is long enough to be
very strong, and made of real words so you can remember and type it. The strength comes from the
words being picked at random, not chosen by you. People choose phrases with
meaning, such as song lyrics, quotes and names, and attackers try those first.
Each word is drawn from 7,776 possibilities, adding about 12.9 bits of entropy. Six words give about 77 bits, enough for most accounts. For a password manager's master password or disk encryption, use seven or eight.
| Words | Entropy | Average time to crack offline* |
|---|---|---|
| 4 | 51 bits | about 5 hours |
| 5 | 64 bits | about 5 years |
| 6 | 77 bits | about 35,027 years |
| 7 | 90 bits | about 272 million years |
| 8 | 103 bits | longer than the age of the universe |
* At 100 billion guesses per second, a well-funded attacker against a fast, unsalted hash. Slow hashes like bcrypt or Argon2 make attacks thousands of times slower.
Where to use a passphrase
- Your password manager's master password: the one password you must remember.
- Your computer or phone login, and full-disk encryption.
- Wi-Fi passwords that guests need to type.
- Anywhere you have to type a password by hand on a phone or TV.
Questions
What is the EFF wordlist?
A list of 7,776 English words published by the Electronic Frontier Foundation for "diceware" passphrases. The words are common, easy to spell and distinct from one another. The list size matches five rolls of a six-sided die, so you could also make a passphrase with real dice.
Should I capitalize words or add a number?
Only if a site requires it. Each extra word adds far more strength than capitalization or a digit does, and keeps the phrase easier to type.
Are my passphrases sent anywhere?
No. The wordlist is downloaded once, and every word is picked on your device by a generator that isn't allowed to send anything.