Runs in your browser · nothing is uploaded

Passphrase Generator

This passphrase generator makes a random passphrase of whole words — from the 2,048-word BIP39 English list or your own word list — with a separator of your choice and its estimated strength in bits. Phrases under 64 bits are refused.

Mode InputCountSeparator

Uses the 2,048-word English BIP39 list with independent cryptographic selection; this is a password passphrase, not a wallet recovery phrase. Minimum estimated entropy is 64 bits. Custom lists must be unique and independent; entropy is only an estimate.

Result

How the passphrase is generated

Each wordcrypto.getRandomValues → uniform index into the list (rejection sampling, no modulo bias)
Entropywords × log₂(list size) = 8 × log₂(2,048) = 88.0 bits
Minimumentropy ≥ 64 bits, or the tool shows an error instead of a phrase

Words are chosen independently, so the same word can appear twice — that is counted correctly in the estimate. The built-in list has 2,048 words of 3–8 letters, and no two share the same first four letters (2,048 distinct prefixes), so a phrase is easy to type and hard to misspell. A default 8-word phrase is typically around 50 characters long. You can generate 1 to 100 words with any separator.

Worked example: how many words?

Built-in list, 11.0 bits per word. The last column assumes an attacker with your password hash, a fast unsalted hash and 100 billion guesses a second — a pessimistic case. Sites that use a slow hash like bcrypt or Argon2, or that rate-limit logins, are far harder to attack.

Words	Bits	Allowed	Average time to guess
4	44.0	no	1 minute
5	55.0	no	2 days
6	66.0	yes	12 years
7	77.0	yes	23,943 years
8default	88.0	yes	49 million years
10	110.0	yes	205,667 billion years

For comparison, a fully random password from the 94 printable keyboard characters has 78.7 bits at 12 characters and 104.9 bits at 16. Each extra word adds 11.0 bits and multiplies the guessing time by 2,048.

Word lists, Diceware and good passphrase habits

Words needed for 64 bits by list size

Word list	Bits per word	Minimum words
100 custom words	6.6	10
1,000 custom words	10.0	7
BIP39 English (built in)	11.0	6
Diceware / EFF large list	12.9	5

Diceware, published by Arnold Reinhold in 1995, picks words from a 7,776-word list by rolling five dice per word; the EFF's 2016 large list uses the same size. The xkcd comic "Password Strength" (2011) popularized the idea with four random common words. A custom list only helps if its words are truly distinct and picked at random — a list of your pets and hobbies is not.

Using a passphrase safely

Keep the words the tool picks. Swapping in words you like, or rerolling until it "sounds nice", lowers the real entropy below the number shown.
One phrase per account. Reuse turns one site's breach into many. Use passphrases where you must type from memory — a password manager's master password, a computer login, disk encryption — and let the manager generate the rest.
Length rules are on your side. NIST SP 800-63B tells sites to accept passwords of at least 64 characters and not to impose composition rules, but some still cap length — choose a shorter separator or fewer words there.
Add two-factor authentication. A strong phrase doesn't protect you from phishing; 2FA and passkeys do.

Sources: BIP-0039, "Mnemonic code for generating deterministic keys" (English word list); A. G. Reinhold, "The Diceware Passphrase Home Page" (1995); Electronic Frontier Foundation, "Deep Dive: EFF's New Wordlists for Random Passphrases" (2016); xkcd 936, "Password Strength"; NIST SP 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management. Checked 15 October 2026.

Passphrase or random password?

Choose a passphrase when you'll type it

Master passwords, device logins, Wi-Fi keys you read out to guests, and anything typed on a phone keyboard. Whole lowercase words avoid symbol hunting, and a hyphen or space separator keeps them readable.

Choose a random password when a manager fills it in

For accounts your password manager fills in, memorability doesn't matter, so a 16–20 character random password packs more strength into less space and fits sites with short length limits.

Frequently asked questions

How many words should a passphrase have?+

With the built-in list each word adds 11.0 bits, so 6 words is the minimum here (66.0 bits) and the default of 8 gives 88.0 bits. Use 8 or more for a password manager master password or disk encryption; 6–7 is fine for an ordinary account behind rate limiting.

Is a passphrase more secure than a random password?+

Per character, no; per thing you have to remember, often yes. A random 8-word phrase has 88.0 bits — more than a 12-character random password (78.7 bits) and less than a 16-character one (104.9 bits) — but eight words are far easier to type and recall than 16 symbols.

What does "bits of entropy" mean?+

It's the size of the pool an attacker must search, as a power of two. Each extra bit doubles the guesses. 8 words from 2,048 gives 2,048⁸ = 2^88.0 possible phrases. The figure assumes the attacker knows your word list and word count — which is why the words must be picked at random, not by you.

Can I use my own word list?+

Yes — choose Custom word list and paste words separated by spaces or new lines. Exact duplicates are removed, and the tool tells you if you need more words: a 7,776-word Diceware list needs 5 words for 64 bits, a 1,000-word list needs 7, and a 100-word list needs 10. Use only distinct words — near-duplicates like "cat" and "Cat" both count, which overstates the estimate.

Is this a crypto wallet seed phrase generator?+

No. It uses the same English word list as BIP39 seed phrases, but it doesn't add the checksum that wallet software requires, so the output isn't a valid recovery phrase. Never create or store a wallet seed in a website — use your wallet or hardware device.

Can I change the separator or add capitals and numbers?+

Type any separator, such as a space or a dot. If the box is empty, words are joined with hyphens, so a phrase with no separator isn't possible. The tool doesn't add capitals or digits; if a site demands them, add one of each by hand. That satisfies the rule without making the phrase meaningfully weaker or stronger.

Why does it refuse phrases under 64 bits?+

Below that, a well-funded offline attack on a leaked password hash becomes realistic. The tool estimates entropy before showing anything, so asking for 5 built-in words (55.0 bits) gives an error instead of a weak phrase.

How long would it take to crack a passphrase?+

It depends on how fast an attacker can guess, which depends on how the site stores passwords. As an illustration, at a trillion guesses per second against a leaked hash, finding a random 6-word phrase (66.0 bits) takes about 1.2 years on average, and an 8-word phrase (88.0 bits) about 5 million years. Sites that use slow password hashing make every guess far more expensive.

Is this the same as Diceware?+

It follows the same idea — words chosen at random, not by you — but uses your browser's cryptographic random generator instead of physical dice, and the 2,048-word BIP39 list instead of the 7,776-word Diceware list. Each BIP39 word adds 11.0 bits against 12.9 for a Diceware word, so you need slightly more words for the same strength. To use a Diceware list, paste just its words — without the five-digit dice numbers, which would otherwise count as words — into Custom word list.

Are the words easy to type?+

Yes — the list was designed for writing down and typing. Words are 3 to 8 letters long (5.4 on average), and no two share the same first four letters, so an 8-word phrase with hyphens is about 50 characters. There are no capitals, accents or punctuation to trip over.

Is my passphrase sent or stored anywhere?+

No. Words are picked in your browser with crypto.getRandomValues, and the phrase is never uploaded, logged or saved. Clear the page when you're done, and store the phrase in a password manager rather than a text file.