Free Random Passphrase Generator
Make a memorable password from random words: easy to remember, easy to type, and hard to guess. It is the xkcd idea and the Diceware method done properly, with a secure random number generator and an honest strength count. The default, seven random words, is strong enough for almost anything you type by hand.
Choose 3 to 12 words, what goes between them, capitals, a number, a symbol, and a maximum length. Words come in many languages: pick yours with the globe button. Don’t like one word? Tap it to swap just that one. The passphrase is made on your device and never sent anywhere.
Jump to: What is it for? · How many words? · Three random words · How to remember it · Questions
What Is the Passphrase For?
A passphrase is for a secret you type yourself. Pick the job and the generator opens with the right settings.
- Master passwordThe one password you can never forget: it unlocks your password manager. Capitals and a number satisfy apps that insist on them.8 words · capitals · a number
- Disk encryptionBitLocker, FileVault, VeraCrypt, or LUKS. It guards everything on the disk, so it gets the most words.8 words
- SSH or GPG keyUnlocks your private key each time you use it.7 words
- Said aloud or typed on a TVPlain words with spaces are easy to read out over the phone or type with a remote.7 words · spaces
- A site with strict password rulesCapitals, random digits between the words, and one symbol meet “upper, lower, number, and symbol” rules.6 words · capitals · digits between · a symbol
- Three random wordsThe UK government’s advice for online accounts. Fine where the site limits wrong guesses and you use two-step sign-in. Too weak for anything else, as explained below.3 words · capitals · a number · Weak if a password file is stolen
- New accounts for a teamTen different passphrases, one per line, each with its own copy button. For a whole class or company, use the bulk generator.10 passphrases, 7 words each
- Website or app accountIf you never type it, a random string is shorter for the same strength.Password generator
How Many Words Do You Need?
Every word you add makes a passphrase thousands of times harder to guess (about 7,400 times with the English list), because an attacker has to try every word in the list for each one. Seven random words, our default, suit almost anything you type by hand: a computer login, Wi-Fi, or an SSH key. Use eight for a password manager or an encrypted disk. Three or four words are only for accounts that block wrong tries, as explained below.
The time under the generator is the worst case: the attacker knows your word list and has a copy to guess against on their own computers, with no limit on tries, such as a password list stolen from a website. For the passphrase shown in the generator, here is how long it takes with 1,000 graphics cards, depending on what they have a copy of:
Your passphrase7 wordsEnglishAbc123!@#
- Hacked website Sets the rating
- 98,000 years
- Very strong
- A password list stolen from a website, stored in a fast form
- Wi-Fi
- 5.8 billion years
- Very strong
- A recorded Wi-Fi handshake. WPA2 makes every guess slow
- Password manager or drive
- 160 billion years
- Very strong
- A copied password manager vault or encrypted drive, built to be slow to guess
With one gaming PC, every time above is 1,000 times longer. With 100,000 graphics cards, the scale of a government or a big tech company, it is 100 times shorter.
A website or device with proper protection is far slower to attack: it blocks repeated wrong tries and stores passwords in a form that is slow to guess. You can’t see how a website stores yours, though, so don’t count on it.
Capitals add almost nothing, because an attacker can capitalize every word too. A number or symbol adds a little. Another word adds the most. If a site has a length limit, open Any length and choose it: the generator then makes only passphrases that fit, and the strength line drops to match.
Is a 3 Word Password Enough?
The UK’s National Cyber Security Centre tells people to use “three random words”, and plenty of people now look for a 3 word password generator. The advice is sound for what it was written for: an online account that blocks repeated guesses, ideally with two-step sign-in. Guessing three random words through a sign-in page at 10 tries a second would take around 650 years.
The catch is a data breach. If the site’s hashed passwords are stolen, the same three words fall in less than a second, and capitals, a number, and a symbol hardly help. So use three words only where the NCSC means them. For a password manager, a computer login, Wi-Fi, or an encrypted disk, use seven or more. The Three random words example above opens the generator with NCSC-style settings, and the strength line shows honestly how weak it is.
An xkcd Password Generator, Done Properly
The famous xkcd comic argued that four random common words are easier to remember than “Tr0ub4dor&3” and harder to crack. It was right about the idea. Its numbers were only an illustration, though: four words from a list of 2,048 is 44 bits, which a single graphics card gets through in under a minute.
This generator keeps the idea and fixes the numbers: lists of thousands of words (about 7,400 in English) instead of 2,048, seven words by default instead of four, no word twice, and a secure random number generator instead of a person picking. Seven words give about 90 bits: about 100,000 years, even for 1,000 graphics cards.
The “random” part matters most. People who choose their own words pick lyrics, quotes, names, and places, and cracking tools try those first. Even “correct horse battery staple” from the comic now turns up in data breaches thousands of times. Words picked at random have no pattern to find, so the numbers hold even if an attacker knows you used PassGen.co. Already using a passphrase you made up? Test it in the password strength checker.
How to Remember a Passphrase
- Make a picture. Imagine the words as a short, silly scene, in order. A walrus with a lantern in a canyon sticks far better than seven separate words.
- Type it often at first. Use it several times a day for the first week. After that, your fingers remember it.
- Write it down while you learn it. Keep the paper at home, never with the device it unlocks, and destroy it once you know the passphrase by heart.
- Keep the separators. Hyphens or spaces show where you went wrong, and cost nothing.
Passphrases in Your Own Language
Words you know are easier to remember and type. Choose your language with the globe button. Every list keeps thousands of words after the clean-up, and the strength under the generator always counts the exact list you choose, so a smaller list shows a lower strength for the same number of words.
Ukrainian and Russian also come in Latin letters, because the start-up screen of an encrypted laptop, a TV, or a router’s admin page often has only a US keyboard, and a passphrase you cannot type there locks you out. For the same reason, test a disk-encryption passphrase at the start-up screen before you rely on it, or use a list without accents.
English (short words) uses words of three to five letters, quicker to type on a phone or a TV remote. With fewer words to choose from, each one adds less, so use nine short words for the strength of seven from the main list.
How It Works: Technical Details
For anyone who wants to check the details.
Secure randomness
each word is picked with crypto.getRandomValues(), using rejection sampling so every word is exactly as likely as every other. A word already in the passphrase is drawn again, so no word appears twice.
Strength estimate
the exact number of different passphrases the settings can make. Without a maximum length that is N × (N − 1) × … for the number of words, from a list of N words. Random digits between words multiply it by 10 per gap, “add a number” by 10 × words (which digit, which word), and “add a symbol” by 8 × words (one of ! @ # $ % ^ & *, which word). Capitals add nothing, and neither does a Custom separator, because you chose it. Bits = log2 of that number. Time to crack = 2bits − 1 ÷ (2 × 1014) seconds, for 1,000 graphics cards.
Maximum length
the generator counts exactly how many passphrases fit, by working through the list’s word lengths, and draws one of those at random, every one equally likely. The strength is the count of those that fit.
Swapped words
for each word swapped k times, the strength drops by log2(k + 1) bits, the most that choosing one of k + 1 words can give away.
Dice-sized lists
most lists start with 7,776 words, which is 6 × 6 × 6 × 6 × 6, the number of ways five dice can land. That is the Diceware method: roll five dice and look up a word. Some start with more, such as 8,192, and the short English list has 1,296, for four dice. Because of the clean-up below, the generator uses your browser’s random number generator rather than dice numbers.
Clean-up
words that contain a separator character, such as “yo-yo”, are removed so they cannot blur where one word ends. So are the names of people and places, even when a list writes them in lowercase, and words that would be unpleasant or awkward in a passphrase you might say aloud, such as illnesses, drugs, weapons, and slurs. The strength uses the number of words left in each list, shown under Word lists, so it stays exact.
Word lists
where each list comes from, its licence, and how many words it keeps after the clean-up. Lists marked PassGen.co were built for this site from the sources named.
| List | Words | Source and licence |
|---|---|---|
| English | 7,424 | EFF Long Wordlist · CC BY 4.0 |
| English (short words) | 1,234 | EFF Short Wordlist 1 · CC BY 3.0 US |
| Deutsch | 6,947 | ulif diceware · CC BY |
| Español | 5,962 | ulif diceware · CC BY |
| Français | 7,347 | Tails · CC0 |
| Italiano | 7,667 | ulif diceware · CC BY |
| Português | 7,429 | PassGen.co: OpenSubtitles (hermitdave/FrequencyWords), Wikipedia · CC BY-SA 4.0 |
| Català | 7,186 | ulif diceware · CC BY |
| Nederlands | 7,337 | mko.re · CC BY |
| Polski | 7,179 | PassGen.co: OpenSubtitles (hermitdave/FrequencyWords), wordfreq, Wiktionary · CC BY-SA 4.0 |
| Čeština | 4,750 | PassGen.co: OpenSubtitles (hermitdave/FrequencyWords), wordfreq, Wiktionary · CC BY-SA 4.0 |
| Türkçe | 3,529 | PassGen.co: OpenSubtitles (hermitdave/FrequencyWords), wordfreq, Wiktionary · CC BY-SA 4.0 |
| Bahasa Indonesia | 6,371 | PassGen.co: OpenSubtitles (hermitdave/FrequencyWords), wordfreq, Wiktionary · CC BY-SA 4.0 |
| 日本語 (ローマ字) | 7,168 | PassGen.co: JMdict (EDRDG), wordfreq, OpenSubtitles (hermitdave/FrequencyWords) · CC BY-SA 4.0 |
| Українська | 7,430 | git-leaf · MIT |
| Українська (латиницею) | 7,480 | git-leaf · MIT |
| Русский | 7,608 | PassGen.co: OpenRussian.org · CC BY-SA 4.0 |
| Русский (латиницей) | 7,608 | PassGen.co: OpenRussian.org · CC BY-SA 4.0 |
Frequently Asked Questions
What is a good passphrase example?
Something like velvet-harbor-sketch-lantern-cactus-walrus-canyon: seven words with no connection to each other or to you. Never use an example you have seen published, including this one. Make your own above.
Is a four-word passphrase secure?
Only where wrong guesses are limited, such as a phone that locks after a few tries. If the hashed passphrase were stolen, four words would fall in seconds. Use seven words for accounts and eight for anything that protects other passwords.
What is the difference between a passphrase and a password?
A password is usually a short string of mixed characters; a passphrase is a longer string of words. A passphrase is what most people mean by a memorable password. For the same strength a passphrase is longer, but much easier to type and remember. Use a passphrase for what you type yourself, and a random password for what your password manager fills in.
Is this a Diceware generator?
It uses the same method: words drawn at random from a list sized for dice, most with 7,776 words, the number of ways five dice can land. Instead of rolling dice, it uses your browser’s secure random number generator, which is just as random and much quicker. The strength shown counts the exact list it uses.
Why does a long passphrase show a short time to crack?
Strength depends on how many passphrases your settings could make, not on how many letters they have. An attacker guesses whole words from the list, so long words help no more than short ones, and capitals on every word add nothing. Another word multiplies the time by about 7,400.
Can I change just one word?
Yes. Tap or click the word, or move to it with the arrow keys and press Enter. Only that word changes. The strength line takes a little off for each swap, because a word you picked is slightly less random than one you did not.
Can I make several passphrases at once?
Yes. Open Several passphrases under the result and choose up to 16, each with its own copy button. For a whole class or company, the bulk password generator makes up to 1,000 and exports them for Microsoft 365, Google Workspace, or Active Directory.
Can I use spaces in a passphrase?
Usually. Most websites, operating systems, and encryption tools accept spaces. A few older systems strip or reject them, so if you are unsure, use hyphens. If a site rejects hyphens too, choose Custom and type a character it accepts. The strength is the same either way.
How do I add a passphrase to an SSH or GPG key?
For an existing SSH key, run ssh-keygen -p -f ~/.ssh/id_ed25519 and paste the passphrase when asked. For GPG, run gpg --passwd followed by your key ID. New keys ask for a passphrase when you create them.
Can I use this for a crypto wallet seed phrase?
No. A 12- or 24-word recovery phrase must come from your wallet, which uses its own word list and a built-in checksum, so words from here would not be valid. The optional BIP39 passphrase some wallets offer is different: you choose it yourself, so a passphrase from here works well for it. Store it as carefully as the recovery phrase, because the wallet cannot be restored without it.
Is it safe to make a passphrase online?
Here, yes. The passphrase is made by code that runs in your browser and is never sent to us. Once the page has loaded it works with no internet connection, so you can disconnect before you generate one if you want to be sure.
More tools
- Password generatorRandom letters, numbers, and symbols
- PIN generatorNumber codes that skip the easy ones
- Username generatorNames for accounts and games
- Password strength checkerHow strong is a password, and has it leaked?
- Bulk password generatorPasswords for a whole team or class
- Wi-Fi QR code generatorA QR code that joins your Wi-Fi