Home › Generators & Text Tools › Passphrase Generator
Passphrase Generator
This passphrase generator builds a strong password out of ordinary words — the kind you can actually remember. Pick how many words you want, choose a separator, and add a number or a symbol if a website demands one. Every passphrase comes from a built-in list of 483 common words, picked with your browser's cryptographic random generator, and the tool shows the strength in bits. Nothing is sent to a server, so your passphrase stays yours.
Strength meter
Entropy counts how many guesses an attacker would need. Aim for 40 bits or more for everyday accounts, and 60 or more for anything important.
How it works
A passphrase is a password made of several random words joined together. The idea became famous with the phrase "correct horse battery staple": four ordinary words, picked at random, make a password that is both long and easy to remember. A random jumble of letters such as "Tr0ub4dor&3" is shorter, harder to remember, and — surprisingly — easier for a computer to guess than four random words. Length beats complexity, and words beat symbols when it comes to memory.
This generator picks words from a built-in list of 483 common English words — short, familiar words such as apple, river, mountain, and candle. Each word is chosen independently with your browser's cryptographic random number generator, the same source of randomness that secure websites use. Because the choice is truly random, an attacker who knows the word list still has to try every combination: with 483 words, four words give 483 × 483 × 483 × 483, or about 54 billion combinations. That is the strength of the passphrase, and it is measured in bits of entropy.
Each word adds about 8.9 bits of entropy, because log₂(483) is about 8.9. Four words give about 35.7 bits, five give about 44.6, and six give about 53.5. Adding a digit at the end (one of 0–9) adds about 3.3 bits, and adding a symbol from a set of eight adds 3 bits. Capitalising the first letter of each word adds about 1 bit. The meter beside the tool shows the total and a verdict: under 30 bits is weak, 30–44 is fair, 45–59 is strong, and 60 or more is very strong. For everyday accounts, four or five words is a good minimum; for email, banking, or anything important, use six or more.
The separator matters for two reasons. First, it makes the passphrase readable: "river-candle-mountain-apple" is easier to read than "rivercandlemountainapple". Second, some websites only accept certain characters, so you can pick a hyphen, a space, a dot, or an underscore to suit the site's rules. The number and symbol options are there for the same reason — some sites demand a digit or a symbol in every password. If the site does not demand them, an extra word is a better use of your memory than a symbol.
Two warnings apply to every password tool. First, use a different passphrase for every important account, so one leak does not open all your doors. Second, store passphrases in a password manager rather than in a plain text file. This page never sends your passphrase anywhere, but once you copy it, it is your job to keep it safe.
Worked example
Generate a 4-word passphrase with a hyphen separator, no number, and no symbol.
Step 1: Set the number of words to 4 and the separator to a hyphen.
Step 2: Leave the number, symbol, and capitalisation options off.
Step 3: Press Generate passphrase. The tool picks four words independently from its 240-word list.
Step 4: The words are joined with hyphens, giving a passphrase in the form word-word-word-word.
Step 5: Read the strength. Four words give 4 × 8.9 = 35.7 bits of entropy, which the meter calls fair — fine for a low-stakes account, but add a word or two for anything important.
The exact words are random, so every press gives a different passphrase. One recorded run of the tool with these settings produced street-filter-nature-rocket. Press Generate yourself and you will get a fresh one in exactly the same form: four common words, joined by hyphens, with about 35.7 bits of entropy.
FAQ
What is a passphrase?
A passphrase is a password made of several random words joined together, such as correct-horse-battery-staple. It is long enough to be strong against guessing, but made of ordinary words, so it is far easier to remember than a random jumble of letters and symbols. The famous comic about the correct horse battery staple showed that four random words can be both strong and memorable.
How many words should my passphrase have?
Four words is a good minimum for everyday accounts, and five or six words is better for anything important. Each extra word multiplies the number of possible passphrases by the size of the word list, so one more word adds a lot of strength. This generator lets you pick from three to eight words, and it shows the entropy in bits so you can see the strength grow as you add words.
What does the entropy number mean?
Entropy measures how hard a passphrase is to guess, in bits. A passphrase with 40 bits of entropy has about a trillion possible combinations, and one with 60 bits has about a billion billion. The number comes from the word list and the options you pick: each word adds about 9 bits with this list, a digit adds about 3.3 bits, and a symbol adds about 3 bits. Higher is stronger.
Are the words really random?
Yes. The words are picked with your browser's built-in cryptographic random number generator, the same source of randomness that secure websites use, and the word list is built into this page. The passphrase is generated on your device and is never sent to any server, stored, or logged, so nobody else can see it unless you share it.
Should I add a number or a symbol?
It helps a little, and it is required by some websites that demand a digit or a symbol in every password. A single digit adds about 3.3 bits of entropy and a symbol adds about 3 bits, but adding one more word adds about 9 bits, so an extra word is the better deal if you can remember it. Tick the options you need to satisfy a site's rules, and keep the words as the main source of strength.