Skip to content
XUtilHub

Passphrase Generator – Strong, Memorable Diceware Passwords

Generate strong, easy-to-remember passphrases from random words using the EFF diceware word list, with entropy shown.

  • Free, no sign-up
  • Runs in your browser, nothing uploaded

About the Passphrase Generator

Create passwords that are both strong and memorable: several random words from the EFF diceware list, with your choice of separator, capitals and numbers.

Key features

  • EFF's 7,776-word diceware list
  • 4 to 10 words
  • Choice of separator
  • Optional capitals and a number
  • Entropy shown in bits
  • Secure randomness in your browser

Strong passwords you can actually remember

A passphrase of random words is one of the best kinds of password: long enough to resist cracking, and easy to remember. Pick how many words you want and generate.

Passphrase strength

WordsEntropyGood for
4~52 bitsLow-value accounts with rate limiting
5~65 bitsMost online accounts
6~78 bitsEmail, banking, password manager
7+90+ bitsEncryption keys, high-value secrets

Tips

  • Don't change the words to make a sentence; the randomness is what protects you.
  • Use a different passphrase for every important account, or store them in a password manager.
  • Write it down safely at first, then destroy the note once you remember it.

Word list: EFF Long Wordlist by the Electronic Frontier Foundation, licensed under CC BY 3.0.

Password strength checker, password generator, and secret key generator.

How to use the Passphrase Generator

  1. Enter your text, password or settings in the tool above.
  2. Results appear instantly and are calculated in your browser.
  3. Read the explanation and warnings under the result.
  4. Copy what you need. Nothing is uploaded or stored.

Frequently asked questions

What is a passphrase?

A password made of several random words, like 'creamed-statutory-shadiness-excavator'. It's long, which makes it very hard to crack, yet much easier to remember and type than a jumble of symbols.

How many words should I use?

Each word adds about 12.9 bits of entropy. Five words (about 65 bits) is good for most accounts; six words (about 78 bits) is a strong default, especially for a password manager's master password.

Why must the words be random?

Words you pick yourself, or a famous phrase, follow patterns that attackers try first. Random selection from a large list is what makes passphrases strong.

Where does the word list come from?

The Electronic Frontier Foundation's long diceware word list (CC BY 3.0), designed for memorable, distinct, easy-to-type words.

Are my passwords and files sent to your servers?

No. All checks, hashing and encryption run in your browser using its built-in Web Crypto features. The only network request is the optional breach check, which sends just the first 5 characters of your password's SHA-1 hash, never the password.

Can I trust browser-based security tools?

These tools use the same standard algorithms (AES-GCM, PBKDF2, SHA-2, HMAC) built into your browser. Still, never type the passwords or 2FA secrets of important accounts into any website you don't control.

Do the tools work offline?

Yes. Once a page has loaded, everything except the breach check works without a connection.

Last updated:

Related Security tools