Passphrase generator
Random words you can actually remember, picked with cryptographic randomness. The correct horse battery staple approach, done properly.
Guide
How to use it
- Choose how many words. Four for everyday accounts, five or six for anything that guards money or email.
- Pick a separator and whether to capitalise. These help some password rules pass, they barely change strength.
- Add a number if the site insists on digits.
- Generate until one sticks in your head, the strength is the same every time.
- Click to copy. Say it to yourself twice and you will still know it tomorrow.
Examples
Worked examples
Something like Ridge-Lantern-Spoke-Vivid. Around 30 years of offline cracking, and you can type it on a phone keyboard without swearing.
About 76 bits, the one passphrase worth memorising properly, because it unlocks the password manager holding all the others.
Humans pick memorable, related words: pet, street, football team. Attackers know. The strength comes entirely from the picker being random, so let it pick.
Method
How it works
Each word is drawn uniformly from a list of about 6,500 common English words using the browser's cryptographic random generator, the same technique as rolling dice against the EFF diceware list. Entropy is words times log2 of the list size, roughly 12.7 bits per word, and the crack estimate assumes the attacker knows exactly how the passphrase was made.
The word list loads once into your browser and the words are picked on your device. Nothing is sent anywhere. Built by Wolds Cyber, following the UK NCSC's random-words guidance.
FAQ
Frequently asked questions
What is a passphrase?
A password made of randomly chosen words, like Copper-Sunset-Wallet-Frame. It trades a little length for a lot of memorability, and randomness is what makes it strong.
Why is correct horse battery staple famous?
A well-known xkcd comic showed four random words are both easier to remember and harder to guess than a short password with substitutions. The maths holds up, provided the words are chosen randomly, not by you.
How many words do I need?
With this list, four words give about 50 bits, fine for most accounts. Use five or six for email, banking or a password manager master passphrase.
Which word list does it use?
Around 6,500 common English words of four to eight letters, drawn from a public frequency list. The classic EFF diceware list works the same way; what matters is the size of the list and random selection.
How does this relate to NCSC three random words advice?
The UK National Cyber Security Centre recommends three random words as a practical minimum for human-memorised passwords. This tool is that advice with a true random picker and the option of more words.
Hyphens, spaces or nothing between words?
Whatever the site accepts, it barely affects strength. Hyphens are easiest to read aloud, spaces are fastest to type and some forms reject both, so no separator is offered too.
More tools