Passphrase generator
A passphrase is a password made of random words: five words from the EFF long list, such as correct-horse-battery-staple, give around 65 bits of entropy, more than a 10-character random password, yet you can read it out, type it on a phone and remember it after a few uses. That makes passphrases the right choice for the few passwords you must know by heart: the password manager itself, the computer login, the disk encryption, the main email account.
●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●
Checked on your device with zxcvbn (dictionary words, patterns, dates), loaded only when you type here. Nothing is sent.
The words are picked with the browser's cryptographic random generator from a list of 7 776 words, exactly like rolling five dice per word. Nothing is stored or sent; the list loads once, as a small file, when you open this mode.
Tips
- Four words are enough where the service locks after a few tries; use six or more for anything that can be attacked offline, such as a disk or a vault.
- Capitals and a digit help with sites that demand them, but the strength comes from the number of words, not the decoration.
- Never replace a random word with one of your own: the whole point is that nobody, including you, chose them.
Why it is private
Everything you type or drop here is handled by your browser, on your device. Nothing is uploaded. To verify, open your browser's developer tools, go to the Network tab, and use the tool: you will see no request carrying your data.
Frequently asked questions
- Why words instead of characters?
- Entropy per keystroke is lower, but entropy per memory effort is far higher: a five-word phrase is one short story, twelve random characters are twelve unrelated things to recall. For passwords a manager fills in, random characters remain fine.
- Does the separator matter?
- Barely. A dash or a space keeps the words readable; an attacker is assumed to know the list and the separator anyway. The security is in the number of words.