Diceware Passphrase Generator
Random word passphrases with real entropy maths — cryptographic randomness, honest bit counts, and a clear account of what each word actually buys you.
Words are drawn with the browser's cryptographic random generator (rejection-sampled, so every word is exactly equally likely) from a curated 1,028-word list — 10 bits per word. The entropy math assumes the attacker knows the wordlist and method; the strength is purely the number of combinations, which is how passphrase security should be measured.
This list holds 1,028 words, which makes every word worth ten bits
Entropy per word is log₂ of the list length, and 1028 is four more than 1,024 — so each word carries 10.0056 bits. Near enough to ten that the strength of a phrase is just ten times the word count, and the shortcut never drifts by a tenth of a bit.
| Words | Bits from this list | Ten a word | With classic Diceware |
|---|---|---|---|
| 4 | 40.0 | 40 | 51.7 |
| 5 | 50.0 | 50 | 64.6 |
| 6 | 60.0 | 60 | 77.5 |
| 7 | 70.0 | 70 | 90.5 |
The classic Diceware list is 7,776 words because that is 65 — five dice give you a word — which is 12.92 bits each, 2.92 more than here. Three bits is a factor of 7.6 in list size, and the practical consequence is a word count: six Diceware words are 77.5 bits, which takes 7.75 words here, so 8. A shorter list is not weaker — it is more typing for the same strength, and the generator above computes its figure from the real list rather than quoting the number people expect. Worth saying plainly, because the questions further down this page describe classic Diceware and quote 12.9 bits a word and 78 for six. Those are the right numbers for Reinhold's list and the wrong ones for this one: six words here are 60 bits, not 78. Trust the figure the generator prints. Doubling any wordlist adds exactly one bit per word, whatever it started at.
The words are unique at five characters, not four
Real Diceware has a property worth having: the first four characters identify the word, so you can type four and stop. Checking this list:
| First N characters | Distinct | Words sharing a prefix |
|---|---|---|
| 3 | 707 | 321 |
| 4 | 987 | 41 |
| 5 | 1,028 | 0 |
Five characters are enough and four are not. 38 groups collide at four — angel and anger, beach and beacon, butter and button, camel and camera — which is a fair price for a list of short familiar words, and worth knowing before you decide to abbreviate.
9 words matter more than any of those, because they are a complete prefix of another word on the list: pen pump sand sea ski tea van wind wren. “Pen” runs into “pencil” and “sea” into “seal”, so a phrase written without separators is genuinely ambiguous in a way that a four-character collision is not. Keep the separators.
And every word is short, plain and lowercase
3 to 9 letters, averaging 5.28, with 708 of the 1028 — a clear majority — at five or six. Nothing has an apostrophe, a hyphen, an accent or a capital.
| Letters | Words | Share |
|---|---|---|
| 3 | 26 | 2.5% |
| 4 | 188 | 18.3% |
| 5 | 417 | 40.6% |
| 6 | 291 | 28.3% |
| 7 | 89 | 8.7% |
| 8 | 14 | 1.4% |
| 9 | 3 | 0.3% |
So a phrase types the same on any keyboard layout and survives being read down a phone. At the 8-word setting that is about 49 characters including separators. That is the real constraint on a list like this: adding rarer words would buy bits — doubling it adds exactly one per word — but it costs spelling, and a passphrase you cannot reproduce is not a passphrase.
How to use
- Choose how many words you want.
- Read the entropy figure before accepting it.
- Generate and record the passphrase somewhere safe.
- Use six words or more for anything that matters.
Frequently asked questions
What is Diceware?
A method devised by Arnold Reinhold in 1995 for generating passphrases by rolling dice to select words from a numbered list of 7,776 — five dice giving one word. The list size is six to the fifth power precisely so that five dice rolls select exactly one word with no bias.
How much entropy does each word add?
About 12.9 bits, since one word from 7,776 equally likely options is log base two of 7,776. Six words give roughly 77 bits, and seven about 90. Those figures hold only if the words are chosen by genuine randomness — picking words yourself destroys the calculation entirely.
Does it matter that an attacker knows the word list?
Not at all, and this is the point people find counterintuitive. The strength comes from the number of possible combinations, not from secrecy about the method. The list is public by design, and the entropy figures already assume the attacker has it.
How many words do I need?
Six is the common recommendation for general use, and seven or eight for anything protecting something valuable — a password manager's master password, or an encryption key. Four or five is too few against a well-resourced attacker with modern hardware.
Can I change the passphrase to make it more memorable?
Not without cost. Swapping a word you dislike, reordering to make a sentence, or dropping one reduces the entropy below the figure shown, sometimes substantially. If you dislike the result, generate another rather than editing it.
Why is a random passphrase better than a clever one?
Because human-chosen phrases are far more predictable than they feel. Song lyrics, quotations and common phrases are in attackers' wordlists, and even original sentences follow grammatical patterns that narrow the search enormously. Randomness is the whole basis of the entropy claim.
🔒 This tool runs entirely in your browser. Nothing you enter is uploaded, logged, or stored.