Free tool · Passwords
Free passphrase generator: random words that are easy to type
A passphrase is a password made of random words, like plaza-footpath-tumble-ample-sage-velvet. This free generator picks the words at random from the EFF Long Wordlist, in your browser, so the result is strong and still easy to type and remember.
The tool starts when the page has loaded. It needs JavaScript.
Long random passwords are strong but hard to type and impossible to remember. A passphrase solves both: a few random words, like plaza-footpath-tumble-ample-sage-velvet, are as strong as a jumble of symbols and much friendlier to fingers and memory. This passphrase generator picks the words at random in your browser, from a list made for exactly this job.
How to use the passphrase generator
- Choose how many Words, from 3 to 12. Six is a strong choice for everyday use.
- Choose what goes Between words: a hyphen, a space, a period, an underscore or nothing.
- Turn on Capitalize each word or Add a number if a website insists on capitals or numbers.
- Press Copy, and New for another passphrase.
The bar shows the strength in bits for the words you chose. It counts only the random choice, which is what an attacker has to guess.
Why random words work
The idea is called Diceware, after the method Arnold Reinhold published in 1995: roll five dice, look up the number in a list of 7,776 words, and repeat. Every word is one of 7,776 equally likely choices, so each word adds about 12.9 bits. The words do not need to be long or rare; they only need to be picked at random.
| Words | Strength | As strong as a random password of |
|---|---|---|
| 4 words | 51.7 bits | 8 characters of every kind |
| 5 words | 64.6 bits | 10 characters of every kind |
| 6 words | 77.5 bits | 12 characters of every kind |
| 7 words | 90.5 bits | 14 characters of every kind |
| 8 words | 103.4 bits | 16 characters of every kind |
The famous comic "correct horse battery staple" (xkcd, 2011) made the same point: four random common words beat a short password full of symbols, and you can remember them. Today we suggest six words for anything important, because computers that guess passwords keep getting faster.
About the word list
The tool uses the EFF Long Wordlist from the Electronic Frontier Foundation. Its 7,776 words were chosen to be easy to type and spell, and no word is the beginning of another, so a passphrase stays as strong when you join the words with no separator. The list is published under a Creative Commons Attribution license; the tool names its source under the generator.
The list loads once from barside.space when you open this page. After that, every passphrase is made on your computer with crypto.getRandomValues, your browser's cryptographic random source.
When to use a passphrase, and when a password
- Use a passphrase for anything you type by hand: your computer's login, your password manager, a disk encryption key, a Wi-Fi network you share with guests.
- Use a random password for website accounts that your password manager fills for you. Nobody types those, so the shorter and denser random password is fine, and it fits websites that limit the length.
- Check what you already use with the password strength checker. It shows which patterns make a password weak.
How strong is strong enough?
It depends on what the passphrase protects. For a computer login or a phone, where the system limits how fast someone can guess, five words are plenty. For a password manager's main password or a disk encryption key, which an attacker could attack offline at full speed, use six or seven. Each extra word multiplies the work by 7,776, so adding one word is the easiest way to be sure.
Keep it safe
A passphrase you type every day is easy to remember after a week. Until then, keep it in a safe place, not on a sticky note on the screen. For the rest of your accounts, a password manager does the remembering. Barside has one built in: Barside Passwords stores logins encrypted on your own computer, fills them on Windows and copies them on Linux and Mac. It is free.
Tips for strong passphrases
- Do not change the words to make them "nicer". Swapping a word for one you like better weakens the random choice.
- Do not reuse a passphrase. Use one for each thing it protects.
- Write it down only while you learn it, and keep the paper somewhere private.
- Pair it with two-step sign-in wherever you can.
FAQ
Questions and answers
How many words should a passphrase have?
Six random words from this list give about 77 bits, enough for a password you type every day, such as the one for your computer or your password manager. Use seven or eight words (about 90 to 103 bits) for something that protects many other secrets, such as an encryption key.
Is a passphrase as strong as a random password?
Yes, when the words are picked at random. Each word from a list of 7,776 adds about 12.9 bits, the same as two random characters of every kind. A six-word passphrase is as strong as a random 12-character password and easier to type and remember.
Can I pick the words myself?
Not if you want it to be strong. People pick words that go together, and attackers know it. The strength comes from the random choice, which the tool makes with your browser's cryptographic random source.
What is the EFF Long Wordlist?
A list of 7,776 English words published by the Electronic Frontier Foundation for making passphrases with five dice. The words are easy to spell and type, and no word is the start of another, so the words still count when you leave out the separators.
Is the passphrase sent anywhere?
No. The word list is a file on barside.space that your browser loads once; the choice of words happens on your computer, and the result is never sent or saved.
What if a website wants a number or a capital letter?
Turn on Capitalize each word and Add a number. They add a little strength and satisfy those rules. If a website caps the length below your passphrase, use the password generator for that site instead.