Passphrase Generator

How to use Passphrase Generator

1. Choose how many words — six or more for anything that matters.
2. Pick a separator that the target system will accept.
3. Generate, and regenerate until you get a phrase you find easy to picture.
4. Store it in a password manager, or commit it to memory if it is the master.
5. Words are selected with crypto.getRandomValues, not Math.random.
6. Regenerating to get a more memorable phrase is safe — you are still taking a random draw, not choosing words yourself.
7. Nothing is transmitted or stored; the phrase exists only in this tab.

Where the strength comes from

Each word contributes the entropy of the list it was drawn from, not the entropy of its letters. Drawing from a 7,776-word list — the classic diceware size, being 6⁵ — gives about 12.9 bits per word, so six words is around 77 bits and seven is 90. The critical condition is that the words are chosen at random by a machine. A phrase you invented yourself carries a fraction of that, because human word choice is enormously predictable: attackers run dictionaries of song lyrics, film quotes and common phrases precisely because people pick them.

Why length beats symbol soup

“P@ssw0rd!23” is eleven characters of misery to type and perhaps 30 bits of real entropy, because the substitution rules are in every cracking dictionary. “correct horse battery staple” is four random words, far easier to remember, and stronger. That comparison is the point of the famous xkcd strip, and it holds up: the way these fail in practice is not brute force but reuse and phishing, and a passphrase you can remember is one you will not write on a sticky note.

Where passphrases are the right tool

The handful of secrets you must type from memory rather than paste from a manager: the master password for the manager itself, your device login and disk encryption, an SSH key passphrase, a recovery phrase. For ordinary site logins, a long random string in a password manager is better — you never type it, so memorability buys you nothing and the character variety buys you a little. Use each where it fits.

Practical notes on choosing

Six words is a sensible floor and seven or eight is better for a master password. Keep the separator simple; some systems reject spaces, in which case hyphens are fine and cost nothing in strength. Do not “improve” the generated phrase by rearranging the words into something that makes sense — that is exactly the human predictability the method exists to avoid. If a word is one you cannot spell, generate again rather than editing.