Passphrase generator

A memorable password made of words

A passphrase is a password built from several ordinary words picked at random, such as otter-lantern-pickle-violin. As soon as the page opens, the tool suggests one with 4 words joined by hyphens, and every change of setting or click on "New passphrase" draws a fresh one.

Why words? Because your memory holds on to four pictures far better than to a string like K7#qz!Lp. And because strength comes from length and randomness, not from odd characters: a short "complex" password that a person makes up, say Summer2024!, follows patterns that cracking software tries first.

How to use it

1. Set the Number of words, from 3 to 10.
2. Pick the Word language: English by default, or French, Spanish, German or Italian.
3. Pick the Separator: hyphen, space, dot, underscore or none.
4. Tick "Capitalize each word", "Add a digit" or "Add a symbol" if a website needs them. "Remove accents" is ticked by default, which matters for the other languages: French échelle becomes echelle, easy to type on any keyboard.
5. Set the Number of passphrases (1 to 10) to choose from several, then click "Copy". The space bar draws again.

Under the passphrase, the tool shows its length in characters (27 for the example above) and its strength: a number of bits, a level (weak below 40 bits, fair from 40 to 60, strong from 60 to 80, very strong above) and a sentence that spells out the calculation.

How the strength is worked out

The English list holds 1,296 common words. Each word is drawn at random from that list using your browser's cryptographic random number generator, so every word has 1,296 possible values. In bits, that is log2(1,296) = 10.34 bits per word.

The optional digit is one of 10 digits stuck to the end of one of the words: with 4 words that is 40 options, 5.32 extra bits. The symbol is one of 8 characters (! ? # $ % & * @), also placed at the end of a word: 32 options with 4 words, 5 extra bits. The calculation assumes an attacker knows the list and your settings, so the security rests only on the random draw. For comparison, 8 truly random characters out of 94 give 52.4 bits: 5 words match that, 6 words beat it, and both are far easier to remember.

How many words do you need?

4 words are enough for an everyday account on a website that limits login attempts (lockout after several failures, delays between tries): with trillions of combinations, guessing online is out of reach.

6 words or more for anything that can be attacked offline, with no limit on guesses: the master password of a password manager, or the passphrase for full-disk encryption. Each extra word multiplies the number of combinations by 1,296. That is a safety margin, not a guarantee.

The rules that matter

• Random words, not chosen ones. Swap a word for one you like better and the maths no longer holds. A quote, a proverb or song lyrics are not a passphrase: they sit in the lists attackers try.
• A different passphrase for every account. If one site is breached, the others stay safe.
• A password manager remembers all the others, so you only need to learn one passphrase.
• Two-factor authentication wherever it is offered: a code on your phone or a security key on top of the password.

To remember it, picture a scene with the words in order: an otter holding a lantern, eating a pickle while it plays the violin. Type it a few times over the first days rather than just reading it.

A website insists on a digit, a capital or a symbol? Tick the matching options instead of editing the passphrase by hand.

What the tool does not do

The passphrase is created in your browser and is never sent or stored: only your settings are kept on your device for next time. The tool does not check whether a passphrase appears in a data breach and does not keep it, so copy it before closing the page. If you need a classic password made of random characters, the site also has a password generator.

Frequently asked questions

Is an all-lowercase passphrase strong enough?

Yes. Strength comes from the number of randomly drawn words. Capitals barely change the calculation; they mainly satisfy websites that demand them.

Can I use words in another language?

Yes, the strength is the same: every list contains 1,296 words. Choose the language in which you picture the words most easily.

Is a space a good separator?

It is easy to type, but some websites reject or strip spaces. Hyphens are accepted almost everywhere.

Is it a problem if I keep drawing until I like the words?

Drawing again two or three times makes little difference. Sifting at length for words that "speak to you" reduces the randomness: add a word instead.