Overview
There is a quiet war between security advice and human memory, and memory usually loses. Told to invent something unguessable, people produce exactly the kind of secret they cannot retain — then write it on a sticky note, defeating the purpose. Passphrases end the war: a short string of unrelated ordinary words is easy to hold in your head and, if the words are truly random, brutally hard for a computer to stumble upon.
This generator does the picking so your biases cannot interfere. It draws three to eight words from a plain, spellable word list using your browser's cryptographic random source, joins them with your chosen separator, and optionally capitalises each word or tacks on a digit for fussy sites. The entropy estimate updates with every tweak, so you can see precisely what each extra word buys you.
Why words instead of symbols?
Strength comes from the size of the haystack, not from how messy the password looks. If each word is drawn fairly from a list of around 150 candidates, every word multiplies the possible combinations by 150. Four words give hundreds of millions of possibilities; six push past what casual guessing can ever reach. And because words are long, passphrases tend to exceed the minimum lengths that many systems reward.
The catch — and it is non-negotiable — is that the words must be genuinely random. A lyric, a quotation, or your street followed by your dog's name is not a passphrase in this sense, because attackers try exactly those shapes first. Let the generator choose, and resist swapping a word because another ‘feels luckier’ — that feeling is precisely the bias randomness exists to remove.
Features
- Three to eight words per phrase, set by slider or number box to match the rules of whatever you are signing up for.
- Four separator styles — hyphen, underscore, space or dot — for systems that accept some characters and reject others.
- Optional capitalisation of every word, satisfying ‘must contain uppercase’ rules without effort.
- Optional trailing digit, drawn at random, for sites that insist on a number.
- Honest entropy estimate in bits with a plain strength label, recalculated on every change.
- Instant regeneration — touch any control and a fresh phrase appears; one click copies it.
- Cryptographic word selection with rejection sampling, so every word on the list is equally likely.
- Plain, spellable word list — no obscure vocabulary you will mistype on a phone keyboard.
Benefits
- Memorable by design. Familiar words stick after a few uses — ideal for a master password you type from memory.
- Easy to type. Words beat symbol strings on phone keyboards and TV remotes, with fewer errors.
- Private by architecture. The phrase is assembled in your browser; no server copy could ever leak.
- Measurable strength. The estimate is arithmetic, not marketing — add a word and watch the number climb.
Who can use it
Anyone who needs a strong secret they sometimes type by hand: the master password of a password manager, a laptop login, a Wi-Fi key read out to guests, an encryption passphrase for backups. It also suits people who find symbol-heavy passwords hostile — a password people avoid using soon gets replaced by a weaker one. Teams can use it for shared credentials that must be spoken over a call without spelling every character.
How to use
- Start with four words for ordinary accounts, five or six for a master password or anything guarding valuable data.
- Pick a separator the destination accepts — hyphens are the safest default; use spaces only where you are sure they are allowed.
- Leave capitalisation on if the site demands an uppercase letter; add the trailing digit if it demands one.
- Read the entropy estimate and aim for a strong or very strong label on important accounts.
- Press Copy, paste it where it belongs, store it in a manager — and generate a different one for every account.
Frequently asked questions
Is a passphrase really as safe as a random character password?
It can be, once it is long enough. Safety is measured in entropy, not in visual messiness. A randomly drawn five-word phrase from this list carries more entropy than most eight-character passwords people actually choose — and it has the practical advantage that you will remember it instead of writing it down.
How is the entropy estimate worked out?
Each word contributes the base-2 logarithm of the list size — a little over 7 bits for a list this size — multiplied by the word count. A trailing digit adds about 3.3 bits, and capitalisation counts roughly one bit per word. The total assumes the attacker knows exactly how the phrase was built, which is the honest way to estimate.
Can I swap a word I don't like?
Press generate for a completely fresh phrase — that is fine. What weakens the result is hand-picking replacements until the phrase describes your hobbies or family, because then it stops being random. If a word is hard to spell, regenerating the whole phrase is the safer fix.
Why not just make up my own sentence?
Because sentences follow grammar and habit, and cracking tools model both. Phrases built from quotations, lyrics and personal facts get tried early in an attack. A random draw from a word list has no grammar to exploit — the words are neighbours by pure chance.
What if a site limits password length?
Drop to three words and pick a dot or hyphen separator to keep it compact. Three random words still beat most human-invented passwords. If a site caps passwords at a very short length, treat that as a warning sign about the site itself — and protect the account with two-factor authentication.
Does the generator keep a copy?
No. The words are selected in your browser's memory and vanish completely when the tab closes. Nothing is sent over the network, nothing is written to any storage, and nothing is shown to anyone else — the same design as every tool on this site. If you close the page before copying, that phrase is gone for good, which is precisely how a generator should behave.
Conclusion
When a password has to live in your head rather than in a manager, words beat symbols every time. Let the generator draw them fairly, take five or six words for anything that truly matters, and you end up with a secret that is pleasant to type, easy to remember and genuinely tedious to attack.