Passphrase Generator
SecurityGenerate strong, memorable passphrases from a curated word list. Customise word count, separator, and capitalisation — browser-based, no sign-up required.
What is a Passphrase?
A Passphrase Generator creates a sequence of random words drawn from a curated word bank and joins them with a separator of your choice — producing credentials like anchor-raven-maple-frost-62 that are both long enough to be strong and structured enough to be memorable. Unlike a conventional password where every character is independently random, a passphrase groups randomness into recognisable word chunks that the human memory is far better at retaining.
The idea was popularised by XKCD comic 936 ("correct horse battery staple"), which illustrated that four random words are simultaneously easier to remember and mathematically harder to brute-force than a short mixed-character string. The key word is random — passphrases only work when the words are chosen by a truly random process, not by a person. Humans gravitate toward words from a narrow vocabulary slice (pets, places, films) and combine them in predictable ways, which undermines security. This generator eliminates that bias by drawing each word from a 256-word bank using the cryptographically secure crypto.getRandomValues() API.
Each word in the bank contributes exactly 8 bits of entropy — a clean measure based on the 256-word pool size (log₂(256) = 8). A 4-word passphrase therefore provides 32 bits; a 5-word passphrase provides 40 bits; a 6-word passphrase provides 48 bits. Appending the optional 2-digit random number adds a further 6.5 bits. For high-value credentials such as a password manager master key, choose 6 or more words.
For random character-dense credentials such as API keys or system passwords, the Password Generator remains the right tool. For unique technical identifiers, the UUID Generator is more appropriate. A passphrase is specifically designed for credentials a person needs to type or recall directly.
How to use this Passphrase calculator
- Set Number of Words to the word count you need — 4 for quick accounts, 6 or more for a master password.
- Choose a Separator from the dropdown that matches the rules of the site or system you're signing up for.
- Toggle Capitalise Each Word on if the site requires at least one uppercase letter.
- Toggle Append a Random Number on (it is on by default) if the site requires a digit.
- Click Generate — the passphrase appears immediately in the Generated Passphrase output box.
- Click the copy button to copy the passphrase to your clipboard in one click.
- Paste it into the password field and save it in your password manager before closing the tab.
Formula & Methodology
The generator maintains a curated bank of 256 common English words — nouns and adjectives, 4–8 characters each, chosen for memorability and unambiguous pronunciation. The bank size of 256 = 2⁸ gives a clean 8 bits of entropy per word, making strength calculations straightforward. Word selection: each word is drawn usingcrypto.getRandomValues()to fill aUint32Array. Rejection sampling is applied — any value outside the largest multiple of 256 that fits in a 32-bit integer is discarded and resampled — eliminating the modulo bias that would otherwise make certain words marginally more likely than others. Number selection: the optional two-digit number (10–99) is drawn with the same rejection-sampling approach over the range [10, 99], contributinglog₂(90) ≈ 6.5additional bits of entropy. Full entropy table (with number appended): | Words | Entropy (words only) | Entropy (+ number) | |---|---|---| | 3 | 24 bits | ~30.5 bits | | 4 | 32 bits | ~38.5 bits | | 5 | 40 bits | ~46.5 bits | | 6 | 48 bits | ~54.5 bits | | 7 | 56 bits | ~62.5 bits | All generation runs entirely in your browser — nothing is transmitted to any server at any point.