Passphrase Generator
Generate memorable multi-word passphrases with a real entropy estimate, using cryptographic randomness rather than a word you chose yourself.
A duplicate word made the entropy figure a lie — a very small one
The number above is log2(pool size) per word, which is only the true figure when
every draw is equally likely. Auditing the pool turned up a word that appeared twice —
perch, two slots apart, in a run reading "pepper perch perfect perch period".
Nothing could catch it, because the list lived inline in the page with no test able to see it.
That breaks the claim twice over: the pool advertised 2,131 entries but offered only 2130 different answers, and one word was twice as likely as the rest, so the draw was not uniform. The honest measure is Shannon entropy over the actual distribution. Then the interesting part — it barely mattered:
| Bits per word | |
|---|---|
| What the page printed | log2(2131) = 11.057315 |
| What it was actually worth | Shannon H = 11.056376 |
| Overstatement | 0.000939 |
At the maximum of twelve words that is roughly one hundredth of a bit out of 132.7. You would need about 1,065 such mistakes to lose one whole bit of real strength. It was still worth fixing, for reasons that have nothing to do with the arithmetic: a repeated entry can hand you the same word twice in one short passphrase, which reads like a bug whether or not it is one. With it gone the pool is exactly uniform, so the printed number stops being approximately right and becomes exactly right.
A second fix came out of the same audit. July was the only entry that wasn't
plain lowercase — and the capitalisation setting mapped over the words for "Title Case" and
"UPPERCASE" while the "lowercase" option did nothing at all, on the assumption that the pool
was already lowercase. It wasn't, so choosing lowercase could still hand you a "July". Both
halves are fixed, and the list now lives in its own file where a test checks it on every build.
What the pool is, and what each setting is worth
2,130 words, every one 3 to 8 letters and weighted towards the middle — 792 are five letters, 599 are four, and only 12 run to the full eight. Short enough to type, long enough to stay distinct when read aloud.
2,130 is not a power of two, which is why bits-per-word is an awkward 11.0566 rather than a round number — a pool of 2,048 would give exactly 11. The extra 82 words buy 0.0566 of a bit each, or 0.68 of a bit across a full twelve-word passphrase. The pool size was chosen for the quality of the words rather than the tidiness of the arithmetic, which is the right way round.
| Words | Bits | The page calls it |
|---|---|---|
| 3 | 33.2 | Weak |
| 5 | 55.3 | Fair |
| 7 | 77.4 | Strong |
| 9 | 99.5 | Very strong |
| 12 | 132.7 | Very strong |
Worth knowing where the thresholds fall: the default of five words is only "Fair" by the page's own scale. Seven is the first "Strong", nine the first "Very strong".
Three things about the other settings. The separator adds nothing and is correctly left out of the sum — an attacker who knows the tool knows the format, so hyphens versus dots changes how it reads, not how hard it is to guess. The number and symbol together are worth 10.0 bits, which is less than a single extra word at 11.1; if you want more strength, move the slider rather than tick the boxes. And the "Nothing" separator is worth a second thought for a different reason: 53 words in this pool are a prefix of another word, so with nothing between them the result can't always be split back into words. That costs nothing in strength and something in readability.
Checked and not a bug: the random number generator uses rejection sampling to avoid modulo
bias, and divides 0xffffffff — one less than the number of values a 32-bit
integer holds. That looks like an off-by-one and isn't one that matters, because the accepted
range is still an exact multiple of the pool size, so every word stays equally likely. The
only consequence is that the draw retries about once in
3.5 million more often than strictly necessary.
How to use
- Choose the number of words.
- Read the entropy figure before accepting it.
- Use six words or more for anything that matters.
- Do not edit the result to make it nicer.
Frequently asked questions
Why is a random passphrase stronger than a clever one?
Because human-chosen phrases are far more predictable than they feel. Song lyrics, quotations and common phrases are already in attackers' wordlists, and even original sentences follow grammatical patterns that narrow the search space enormously. The entropy figure only holds if the selection was genuinely random.
How many words do I need?
Six is the usual recommendation for general use and seven or eight for anything protecting something valuable — a password manager's master password, or an encryption key. Four or five is too few against a well-resourced attacker with modern hardware.
Does it matter that the wordlist is public?
Not at all, and this is the counterintuitive part. The strength comes from the number of possible combinations, not from secrecy about the method. The entropy calculation already assumes the attacker knows exactly which list was used.
Can I change a word I do not like?
Not without cost. Swapping a word, reordering to make a sentence, or dropping one all reduce the entropy below the figure shown, sometimes substantially. Generating another passphrase is free; editing this one quietly weakens it.
Why use a passphrase rather than a random string?
Because you can remember it. For the handful of secrets you must actually recall — your password manager's master password, your device login — a passphrase is far easier to hold and can be just as strong. Everything else should be a random string in a manager.
Does the passphrase get transmitted?
No. It is generated entirely in your browser using the cryptographic random source, and nothing is sent, logged or stored. Disconnecting from the network and generating one is a reasonable way to confirm that.
🔒 This tool runs entirely in your browser. Nothing you enter is uploaded, logged, or stored.