Why a passphrase can beat a random password
A password like xK9$mQ2!vL and a passphrase like Anchor-Coral-Wagon-Muffin-7 can carry comparable entropy, but the passphrase is far easier for a human to actually remember and type correctly — length comes from word count rather than character density, and words are much easier to recall than arbitrary symbol sequences. This tool draws each word independently from a fixed 1,819-word list using crypto.getRandomValues(), the Web Crypto API's cryptographically secure random number generator, with rejection sampling to keep the selection genuinely uniform rather than only approximately so.
How the word count affects entropy
Each word is chosen independently from the same 1,819-word list, contributing about 10.8 bits of entropy per word (log2(1819)). Five words is roughly 54 bits before any extras — comparable to a fully random 9-character password drawn from upper/lowercase letters, digits, and symbols, but considerably easier to type without mistakes. Adding a random digit contributes about 3.3 more bits (log2(10)). The separator and capitalization choices don't add entropy on their own — they're fixed, predictable transformations, not additional random choices — so turning them on or off doesn't change the entropy figure shown.
The "estimated average brute-force time" assumes an attacker checking the keyspace in random order finds this specific passphrase after checking about half of it on average, at an assumed 10 billion guesses per second — a number we show explicitly because it's an assumption, not a universal constant. The estimate also assumes the attacker knows the exact word list, word count, and generation method — keeping the list secret is not part of the security model here, consistent with standard security practice (a scheme shouldn't depend on its method staying unknown). All of the security comes from the randomness of which words were picked, not from an attacker being unable to guess how the passphrase was built.
Frequently asked questions
How many words should I use?
6 words (the default) is a reasonable baseline for most accounts — 5 words is allowed but triggers a warning here, since at roughly 54 bits it has less margin against a fast offline attack than we're comfortable defaulting to. For a master password protecting a password manager or full-disk encryption, consider 7 or 8 — each additional word adds roughly 10.8 bits of entropy, a meaningfully larger jump than adding a single character to a traditional password.
Does the separator choice affect security?
Not meaningfully. A hyphen, space, period, or underscore doesn't meaningfully change the security — it's a fixed formatting choice, not a random one. Pick whatever a given site accepts (some reject spaces) or whatever's easiest for you to type.
Is a 1,819-word list large enough?
It's smaller than the classic 7,776-word Diceware list (12.9 bits/word vs. this tool's 10.8 bits/word), so we're upfront about the difference rather than rounding up. The gap is easy to close with one more word: 6 words here (about 65 bits) lands close to 5 words of classic Diceware (about 64.6 bits).
Can you see or log the passphrases I generate?
No — the generated passphrase value is processed locally and is never included in any network request made by this generator. The page itself loads normally (fonts, scripts, and so on both use the network, like any web page), but the passphrase text specifically never leaves your device unless you paste it somewhere yourself. If you're not sure where the rest of your habits stand, our Cyber Hygiene Quiz takes about a minute and flags the biggest gaps.
Prefer a traditional random password instead? Try our cryptographically secure Password Generator, or check an existing password with our Password Strength Checker.
Last reviewed: . Methodology: words are drawn from a fixed 1,819-word list via the Web Crypto API's crypto.getRandomValues(), with rejection sampling for uniform selection.