Passphrase Generator

How to use the passphrase generator

1. Choose the Word list: English (EFF, 7,776 words) or French (7,776 words). The list matching the page language is selected first.
2. Move the Number of words slider (3 to 12). Six words is a good default for most accounts.
3. Pick a Separator: Hyphen (-), Space, Period (.), Underscore (_) or None.
4. Choose the Capitalization: lowercase, Capitalize Each Word, UPPERCASE or Random per word.
5. Tick Add a random digit if a site insists on a number.
6. Set How many passphrases you want (up to 20) and press Generate, then Copy.

The Entropy line updates with every change and shows the strength in bits, plus the list size and the bits each word adds.

Why passphrases work

A passphrase such as crumpet-oblivion-wobbly-cactus-jury-pelican is long, easy to type and far easier to remember than x7#Qp!2v. Its strength does not come from the words being obscure. It comes from them being picked at random from a known list. That is the idea behind the Diceware method, where you roll five dice to pick each word from a list of 6^5 = 7,776 entries. This tool does the same with your browser’s cryptographic random number generator (the Web Crypto API) and unbiased sampling, so every word in the list has exactly the same chance of being picked each time.

Because the words are random, you can measure the strength precisely, even assuming an attacker knows which list and settings you used:

Entropy = number of words × log2(list size)

Each word from a 7,776-word list adds log2(7,776) ≈ 12.9 bits. Six words give about 77.5 bits, seven words about 90 bits. Random per word capitalization adds 1 bit per word, and Add a random digit (a digit from 0 to 9 appended to a randomly chosen word) adds log2(10 × number of words) bits, about 5.9 bits with six words. Choosing Capitalize Each Word or UPPERCASE adds nothing, since an attacker can try those variants for free, but they help satisfy password rules.

As a rough guide, the tool labels under 50 bits as weak, 50–79 as reasonable, 80–99 as strong and 100 or more as very strong. For a password manager’s master password or disk encryption, aim for 7 words or more.

The word lists

The English list is the EFF large wordlist by the Electronic Frontier Foundation (CC BY 3.0 US). It avoids offensive and hard-to-spell words and was designed so that words are easy to type. The French list is the “diceware-fr-alt” list by Arthur Pons (MIT licence), built from the Lexique 3 database (CC BY-SA 4.0): common words of 4 to 9 letters, without accents or homophones, so they are quick to type on any keyboard. Both lists have exactly 7,776 words, so the entropy is the same in both languages.

The lists are downloaded from this site the first time you generate, then everything happens on your device. The passphrases are never sent anywhere or stored.