Passphrase generator
Strong passwords you can actually remember: random words, picked securely in your browser.
Your new passphrase
Strong · 65 bits of entropy · would take 5 years to crack by brute force
Why it works
Strong and memorable, at the same time
Random passwords like q7#Lm!2vRz are strong but impossible to remember. Passwords people make up, like Summer2024!, are easy to remember but easy to guess. A passphrase gets the best of both: a few truly random words are long enough to be very hard to crack, yet form a small, silly picture your brain holds on to.
This method is often called diceware, because it was designed to be done with ordinary dice: roll five dice, look up the number in a list of 7,776 words, repeat. PwdForge does the same with your browser's secure random number generator instead of dice.
How many words do you need?
Every word adds about 12.9 bits of entropy. Assuming an attacker who knows exactly how the passphrase was made and can try 100 billion guesses a second:
| Words | Entropy | Time to crack | Good for |
|---|---|---|---|
| 4 | 52 bits | About 5 hours | Low-value accounts only |
| 5 | 65 bits | About 5 years | Most everyday accounts |
| 6 | 78 bits | About 35,000 years | Email, banking, computer login |
| 7 | 90 bits | About 272 million years | Your password manager |
Tips for using a passphrase
- Keep the words the generator gives you. Swapping one for a word you like better makes it weaker.
- Make a mental picture. "Canyon rumble velvet oyster plaza" becomes a velvet oyster rumbling through a canyon to a plaza. Silly images stick.
- Type it a few times in the first days, and it will soon be automatic.
- Use passphrases where you must type from memory. For everything else, let a password manager create and remember random passwords.
Word list: the EFF long word list by the Electronic Frontier Foundation, used under CC BY 3.0 US.
Frequently asked questions
What is a passphrase?
A passphrase is a password made of several random words, such as "canyon-rumble-velvet-oyster-plaza". It is long, which makes it strong, but made of real words, which makes it far easier to remember and type than a jumble of characters.
How many words should my passphrase have?
Five random words is a good minimum for most accounts. Use six or seven for the passwords that protect everything else, such as your password manager, your email or your computer login.
Is a passphrase as secure as a random password?
It can be. Security comes from how many possibilities an attacker has to try. Each word from the 7,776-word list adds about 12.9 bits of entropy, so six words (77 bits) are roughly as strong as a random 12-character password.
Can I choose the words myself?
Please don't. People pick words that belong together, like quotes, song lyrics or favourite things, and attackers try those first. The strength of a passphrase comes entirely from the words being chosen at random.
Does it matter which separator I use?
Not for security, as the calculation assumes an attacker knows your settings. Choose what is easiest to type on the devices you use. Some sites don't allow spaces, in which case a hyphen or period works well.
Where do the words come from?
From the Electronic Frontier Foundation's long word list: 7,776 common English words, chosen to be easy to spell and hard to confuse. The list is part of this page, so no request is made when you generate a passphrase.