What Is a Passphrase?
A passphrase is a password built from a sequence of random, unrelated words rather than a
string of random individual characters. Instead of something like k#9Wq$vL2m,
a passphrase looks like Compass-Ember-Trumpet-Willow-Quartz — a handful of
ordinary, everyday words strung together with a separator. The words themselves are common and
easy to read; what makes the result secure is that the specific combination and order are
chosen entirely at random, with no sentence structure or logical connection between them.
This approach traces back to a well-known idea in password security circles: given enough words drawn from a large enough pool, a short sequence of random words can carry as much entropy as a much longer string of random characters, while being dramatically easier for a human being to actually remember and type correctly.
The most well-known formalization of this idea is the "diceware" method, popularized in the 1990s, where a person rolls physical dice to select words from a published word list, ensuring the selection process itself is genuinely random and not subject to human bias. This generator applies the same underlying principle — genuinely random selection from a fixed, published word pool — but replaces physical dice with the Web Crypto API's cryptographically secure random number source, which is both faster and, for a browser-based tool, more practical to verify and audit than asking someone to roll dice by hand.
Passphrase vs. Password
A traditional random password draws each character independently from a pool of letters, numbers, and symbols — typically around 94 possible characters per position. A passphrase draws each word independently from a much larger pool — over a thousand words in this generator — giving each word roughly 10 bits of entropy on its own, versus roughly 6.5 bits per random character. The trade-off is length: a passphrase needs more total characters to reach the same entropy as a character-based password, but because those characters form real, readable words, the result is far easier to memorize despite being longer.
| Property | Random Password | Passphrase |
|---|---|---|
| Built from | Individual characters | Whole words |
| Entropy per unit | ~6.5 bits/character | ~10 bits/word |
| Typical length for 60+ bits | 10+ characters | 6 words |
| Memorability | Low — requires a manager | High — can be memorized |
| Typing speed | Slow, error-prone | Fast, natural |
| Resistance to shoulder-surfing | Higher (dense symbols) | Slightly lower (readable words) |
Neither approach is universally "better" — they solve different problems. For a password you'll paste from a manager and never type by hand, a random character password is ideal. For the one password you genuinely need to memorize, most commonly your password manager's own master password, a passphrase is almost always the better practical choice.
Why Passphrases Are More Memorable
Human memory is built around meaning, imagery, and narrative — not arbitrary symbol
sequences. A string like xR4]bT9{eN2# has no hooks for your brain to latch onto;
every character has to be memorized as an isolated, meaningless fact. A sequence of real words
like Compass-Ember-Trumpet-Willow-Quartz, by contrast, can be turned into a small
mental image or short story almost automatically — a compass glowing like an ember,
played like a trumpet, resting under a willow, cut from quartz — even though the words
were chosen with zero relationship to each other. This isn't a coincidence; it's a direct
consequence of how associative memory works, and it's the entire practical case for using
passphrases where a password has to be typed from memory.
Password Entropy Explained
Entropy, measured in bits, quantifies how unpredictable a password or
passphrase is. For a passphrase, it's calculated as the number of words multiplied by the
base-2 logarithm of the word pool size: entropy = word count × log₂(pool size).
With a pool of 1,069 words, each word contributes roughly 10.06 bits. This generator calculates
entropy live from your actual selected word count and any add-ons (a number or symbol adds
further entropy on top of the word-based total), rather than showing a generic strength label.
It's worth being precise about why pool size matters as much as word count. Doubling the pool size adds exactly one bit of entropy per word, regardless of how large the pool already is, because entropy scales logarithmically with pool size. Doubling the word count, by contrast, doubles the total entropy outright, since each additional word multiplies the total number of possible passphrases by the pool size again. This is why word count is the primary lever for passphrase strength, while a larger word pool provides a smaller, steadier improvement per word.
| Words | Entropy (words only) | Practical strength |
|---|---|---|
| 3 words | ~30 bits | Weak — crackable quickly |
| 4 words | ~40 bits | Fair — acceptable for low-value logins |
| 5 words | ~50 bits | Good — reasonable for most accounts |
| 6 words | ~60 bits | Strong — solid for most accounts including managers |
| 8 words | ~80 bits | Very strong — excellent for master passwords |
| 10 words | ~101 bits | Extremely strong — effectively brute-force-proof |
How Random Passphrases Are Generated
This generator draws each word independently from a curated pool of 1,069 common, easy-to-spell
English words using crypto.getRandomValues(), the Web Crypto API's cryptographically
secure random source, with rejection sampling applied to eliminate modulo bias — the same
technique used across this site's password generators. Each word position is selected with
equal probability across the full pool, independent of every other position, so the resulting
sequence has no pattern a dictionary-style attack could exploit beyond knowing the pool itself.
If you enable the number or symbol add-ons, that character is inserted using the same
cryptographically secure random source, at a random position relative to the word sequence,
rather than always appended predictably at the end. Every part of the process — word
selection, number generation, symbol selection, and placement — draws exclusively from
the Web Crypto API, with no fallback to Math.random() anywhere in the code.
Brute-Force Attacks Against Passphrases
A brute-force attack against a passphrase built from a known word list works by trying every possible combination of words from that list, rather than every possible character combination. This is why pool size matters enormously: a small pool of a few hundred words makes even a long passphrase vulnerable to exhaustive search, while a pool in the thousands, combined with enough words, pushes the total combinations well beyond any realistic offline attack's reach.
| Entropy | Est. time at 10 billion guesses/sec |
|---|---|
| 30 bits (3 words) | ~1.8 minutes |
| 50 bits (5 words) | ~31 hours |
| 60 bits (6 words) | ~3.7 years |
| 80 bits (8 words) | ~3.8 million years |
| 101 bits (10 words) | Effectively never, with current computing |
It's worth being precise about the assumption behind these estimates: they assume an attacker already knows (or correctly guesses) the exact word pool and generation method being used, which is the realistic worst case for a passphrase generator whose logic is publicly viewable, exactly like this one. Even under that worst-case assumption, six or more words provides strong practical protection, and eight or more is effectively unbreakable with current offline cracking hardware.
To see why pool size matters so much in this worst-case scenario, compare two passphrases of the same six-word length drawn from different pool sizes: a 200-word pool gives roughly 46 bits of entropy, resistant to online guessing but crackable offline within days on modern hardware. The 1,069-word pool this generator uses gives roughly 60 bits for the same six words — a difference of 14 bits, or about 16,000 times more combinations, purely from starting with a larger, more diverse word list. This is exactly why the specific word pool a passphrase generator uses is worth caring about, not just the word count it displays.
Dictionary Attacks and Word-List Assumptions
Dictionary attacks against traditional passwords work by testing real words and common patterns before resorting to brute force. Against a passphrase, the calculus is different: a passphrase is built from dictionary words by design, so the relevant question isn't "does this contain a real word" but "how large is the pool of words being drawn from, and how many words make up the phrase." A four-word passphrase from a small, guessable 200-word list is genuinely weak; a six-word passphrase from a pool of over a thousand words, chosen with genuine randomness, is not — the security comes from the search space, not from disguising the fact that real words are involved.
This is precisely why generator-produced passphrases meaningfully outperform human-invented ones. A person asked to "pick five random words" will unconsciously favor common, emotionally salient, or thematically related words — reducing the effective pool far below what the raw word count suggests. A cryptographically secure generator has no such bias; every word in the pool is equally likely on every draw, which is exactly the property the entropy math above assumes.
Credential Stuffing: A Threat Passphrases Can't Solve Alone
Credential stuffing doesn't guess at all — it replays real email and password pairs leaked from breaches of other, unrelated websites, betting that you reused the same credentials. No amount of entropy, whether from a passphrase or a character-based password, protects you here if the passphrase itself is reused across accounts. The only real defense is uniqueness: generate a fresh passphrase or password for every account, and let credential stuffing find nothing to replay.
Password Managers and the One Passphrase You Should Memorize
The strongest practical setup most people can adopt is this: use a password manager to generate and store a unique random password for every individual account, and protect that manager itself with a single strong passphrase — the one credential in your entire digital life you actually need to memorize and type by hand, often on multiple devices, sometimes under time pressure. This is the exact use case passphrases were built for, and it's the primary reason this generator exists as a standalone tool rather than being buried as a secondary option inside the character-based generators.
When choosing your manager's master passphrase specifically, lean toward more words rather than fewer — 6 to 8 words is a reasonable target for a credential this important, since it's the single point of failure protecting everything else.
How Many Words Should You Use?
| Use case | Recommended words | Approx. entropy |
|---|---|---|
| Low-stakes, throwaway accounts | 4 words | ~40 bits |
| Typical online accounts | 5–6 words | ~50–60 bits |
| Password manager master passphrase | 6–8 words | ~60–80 bits |
| High-security or long-term credentials | 8–10 words | ~80–101 bits |
Five to six words is a sensible default for most accounts — enough entropy to resist realistic offline attacks while staying easy to type from memory. Reserve 8 or more words specifically for credentials that protect everything else, like your password manager's master passphrase or an encrypted drive's unlock phrase.
Where Passphrases Are Used Beyond Password Managers
Password managers are the most common use case, but far from the only one. Full-disk encryption tools, cryptocurrency wallet seed protection, WiFi network passphrases, SSH key passphrases, and encrypted backup archives all typically call for a credential that's both high-entropy and something the owner can actually recall without a manager to hand — often in scenarios like disaster recovery or a new-device setup where the manager itself isn't yet accessible. In every one of these cases, the same trade-off applies: a passphrase gives up a small amount of character-level density in exchange for a large gain in a human's ability to reliably reproduce it correctly, sometimes months or years after it was first created.
Cryptocurrency wallets deserve a specific mention, since many wallet standards already use a word-based recovery phrase rather than a raw private key, precisely because a sequence of common words is far less likely to be transcribed incorrectly than a long string of random hexadecimal characters. The same underlying logic — readable words carry entropy more reliably through a human transcription step than dense character strings do — is exactly what this generator applies to everyday account passwords.
NIST Guidance and Enterprise Passphrase Policy
The U.S. National Institute of Standards and Technology's modern password guidance (NIST Special Publication 800-63B) explicitly supports long, randomly generated passphrases as a valid and often preferable alternative to complex character-composition rules. NIST's current position emphasizes length and genuine randomness over mandatory symbol or number requirements, on the basis that composition rules often push people toward predictable patterns rather than real unpredictability — and a passphrase, built from independently random words, satisfies the length and randomness goals directly without needing to bolt on artificial complexity.
Organizations that still enforce rigid composition requirements (at least one symbol, one number, mixed case) can generally satisfy those rules with a passphrase plus the optional number or symbol add-on this generator provides, while still getting the underlying memorability benefit that makes passphrases practical for staff to actually use correctly, rather than writing down on a sticky note out of frustration with an unmemorable character string.
Passphrase vs. Password Managers vs. Biometrics
It's worth placing passphrases in context against the other major authentication approaches in common use. Password managers solve the "too many passwords to remember" problem by removing memorization from the equation almost entirely, but they still need one credential — the master passphrase — that the human has to hold in their own memory. Biometric authentication (fingerprint, face recognition) offers convenience but isn't a secret at all in the cryptographic sense; it's a stable, un-changeable value used as a local unlock mechanism, and it doesn't solve the same problem as an account credential. Passphrases sit specifically in the gap these two approaches leave open: a genuinely strong, unique credential that a person can actually reproduce from memory when biometrics aren't available and a manager isn't within reach.
Choosing a Separator: More Than a Cosmetic Choice
The separator between words affects usability more than security in most cases, since the entropy calculation above doesn't change meaningfully based on which separator you pick. That said, the choice isn't purely cosmetic. A space is the most natural to type and read, but some older systems and command-line tools handle spaces in passwords poorly. A dash or underscore is universally safe across virtually every platform and still visually separates words clearly. A dot is compact and reads cleanly but can visually blend with certain fonts at small sizes. If you're unsure which a specific platform prefers, a dash is the safest general-purpose default.
Should You Add Numbers?
Adding a random number to a passphrase increases entropy modestly and can help satisfy legacy password policies that still require at least one digit. The entropy gain is smaller than adding an entire additional word — a single random two-digit number adds roughly 6-7 bits, versus the ~10 bits a whole extra word contributes — but it costs almost nothing in memorability if placed as a single number at a natural break point rather than scattered randomly through the phrase. This generator, when the option is enabled, inserts the number using the same cryptographically secure random source as everything else, at a position chosen independently of the words themselves.
Should You Add Symbols?
A random symbol contributes meaningfully more entropy than a number, since the symbol pool used here is smaller in absolute count but the character itself is rarer and more unpredictable in context. The trade-off is the same one symbols always carry: a small hit to easy memorability and typing speed, in exchange for satisfying composition rules some platforms still enforce and for closing off a narrow category of pattern-based attacks that specifically target passphrases with no non-alphabetic characters at all. For most personal use, word count alone provides plenty of security; add a symbol mainly when a specific platform's policy requires one.
Examples of Strong Passphrases
| Example | Words | Why it's strong (or not) |
|---|---|---|
correcthorsebatterystaple | 4 | Weak by modern standards — famous example, now itself a known guessable phrase. |
Compass-Ember-Trumpet-Willow | 4 | Fair — genuinely random, but only 4 words limits total entropy. |
Quartz.Falcon.Meadow.Anchor.Velvet | 5 | Good — solid entropy for a typical account. |
Lantern_Otter_Prism_Harbor_Ember_Cinder | 6 | Strong — comfortable choice for a password manager master passphrase. |
Falcon-Quartz-47-Meadow-Anchor-Velvet-Ember | 6 + number | Very strong — extra entropy from the embedded number. |
The correcthorsebatterystaple example is worth pausing on: it was originally
popularized specifically to illustrate that random words beat complex character substitution.
That remains true as a principle, but the specific phrase itself has since become so widely
referenced that it should never actually be used — any phrase repeated often enough in
security writing effectively joins the dictionary attackers already check first.
Best Practices for Using Passphrases
- Use at least 5-6 words for typical accounts, and 8 or more for a password manager master passphrase.
- Let a generator choose the words rather than picking them yourself, since human selection is measurably less random than it feels.
- Keep the separator consistent and memorable — a dash or space is usually easiest to recall correctly under pressure.
- Never reuse a passphrase across accounts, even though it's memorable enough that reuse feels tempting.
- Add a number or symbol only when a platform requires it, since word count alone typically provides sufficient entropy on its own.
- Pair it with two-factor authentication wherever available, since passphrase strength alone doesn't protect against phishing.
Common Mistakes to Avoid
- Using a famous or widely referenced phrase (like a well-known quote, song lyric, or the "correct horse battery staple" example itself), since these have effectively joined attackers' word lists.
- Choosing words with a real relationship to each other or to you personally — a theme, a memory, a sentence — which reduces effective randomness even if the words look unrelated on the surface.
- Using too few words to save typing effort, undermining the entropy the whole approach depends on.
- Assuming length alone guarantees strength without checking that the underlying word pool and selection method are genuinely random.
- Reusing the same passphrase across multiple accounts because it's easy to remember, which defeats the point under credential stuffing.
Conclusion
A well-built passphrase closes the gap that has always existed between "secure" and "memorable" password advice. Six random words from a large, genuinely random pool carries real, measurable entropy — comparable to a much longer random character password — while remaining something you can actually type correctly from memory under pressure. Use the generator above to build one, choose a word count appropriate to what you're protecting, and reserve your best passphrase for the one credential that guards everything else: your password manager's master password.