Memorable, secure multi-word passphrases — an easier-to-type alternative to a random password.
Strong · 73.6 bits · about 23 thousand years to crack for an attacker making 10 billion guesses a second who knows exactly how it was made.
The Password Generator on this site makes maximally random character strings — great for anything saved in a password manager, but hard to type from memory. This tool solves a different problem: a passphrase built from several unrelated, easy-to-spell words, generated with the same cryptographically secure randomness, that you can actually remember and retype correctly.
A passphrase with enough words (5-6+) from a large word list can be just as resistant to brute-force guessing as a random password of similar length, while being much easier to remember and type correctly — which is the whole point of the approach.
That phrase comes from a well-known illustration of the idea: a handful of unrelated random words is both easier to remember and, with enough words, harder to brute-force than a shorter string of random characters that looks complex but is actually a much smaller search space.
Only if a site requires them. A random number or symbol adds a few bits, but one more word adds about 13 — so when you want more strength, add a word. The number and symbol options are there for sites whose rules demand them.
Use at least 5 words for important accounts such as email or banking, and 6 or more for a password-manager master password or disk encryption. 3–4 words are fine only for low-value accounts, because they can be guessed quickly if a site's password database leaks.
Barely. Choosing one of six options costs less than 3 bits of strength — about a quarter of one extra word — and a passphrase you actually remember is worth far more than one you have to write down.
From the EFF Large Wordlist made by the Electronic Frontier Foundation for passphrases: 7,772 words that are easy to spell, recognise and type (4 hyphenated words are left out). Each random word adds about 12.9 bits of strength. The "short words" option uses only the 2,848 words of 3 to 6 letters, at about 11.5 bits each.
Enter the site's maximum length and only passphrases that fit are shown. Choosing short words or no separator helps a passphrase fit. If even that is too long, use 4 short words with a number, or use the Password Generator instead.
Yes — a passphrase is a genuinely good fit for a master password specifically, since it's the one password you actually need to type from memory regularly.
