What a passphrase is and when it makes sense
A random string such as "Xk7#mQ2!" is hard to guess but nearly impossible to remember, and a string you can remember, such as "password1!", is already sitting in every attacker's dictionary. A passphrase tries to get both properties by chaining several words that were drawn at random, for example "river-castle-thunder-violin". Its strength comes from three things only: how many words are in the list, how many words you draw, and whether the draw was truly random. If you pick words yourself because they sound nice together, the randomness is gone and so is the math on this page. Passphrases fit best where you must type or recall the secret from memory: the master password of a password manager, a disk-encryption passphrase, or the login of the computer itself.
How the entropy is calculated
Entropy, measured in bits, is the number of yes/no questions an attacker would have to answer to pin down your secret even when they know exactly how it was made. If you draw one item uniformly from a list of N items, you get log2(N) bits, and each additional independent draw adds the same amount. The word list behind this generator contains 100 English words, so each word contributes log2(100) = 6.64 bits. The classic Diceware list has 7,776 words (five dice rolls, 6^5), which is 12.92 bits per word. That is the key difference between Diceware and this tool: with the same number of words, a phrase from this 100-word list carries roughly half the strength of a real Diceware phrase. The page compensates by letting you draw up to 12 words, and the entropy shown next to your result is always computed from the real list size, never from a rule of thumb. Appending a single random digit adds only log2(10) = 3.32 bits, so decorating a short phrase with a number does very little.
Strength by number of words (calculated at build time)
| Words | Possible phrases | Entropy (bits) | Average time at 10 billion guesses/s | Average time at 10,000 guesses/s | For comparison: bits with a 7,776-word list |
|---|---|---|---|---|---|
| 3 | 1.00 x 10^6 | 19.9 | under 1 second | 50.0 seconds | 38.8 |
| 4 | 1.00 x 10^8 | 26.6 | under 1 second | 1.4 hours | 51.7 |
| 5 | 1.00 x 10^10 | 33.2 | under 1 second | 5.8 days | 64.6 |
| 6 | 1.00 x 10^12 | 39.9 | 50.0 seconds | 1.6 years | 77.5 |
| 8 | 1.00 x 10^16 | 53.2 | 5.8 days | 15,855 years | 103.4 |
| 10 | 1.00 x 10^20 | 66.4 | 159 years | 1.6 x 10^8 years | 129.2 |
| 12 | 1.00 x 10^24 | 79.7 | 1.6 x 10^6 years | 1.6 x 10^12 years | 155.1 |
The times assume the attacker has to search half of the possible phrases on average, which is the usual simple estimate, and the guess rates are assumptions, not measurements. The 10-billion-per-second column models an offline attack on a stolen password file that was protected with a fast hash; 10,000 per second is closer to an online service that throttles or locks repeated attempts. Real speeds depend on how the service stores passwords (a deliberately slow hash such as bcrypt or Argon2 cuts the rate by orders of magnitude), on the attacker's hardware, and on lockout rules. Treat the table as a ruler for comparing options, not as a promise.
Two worked examples
Example 1: four words. With this list, four words give 100^4 = 100,000,000 phrases, or 26.6 bits. An attacker needs 50 million guesses on average, which takes under 1 second at 10 billion guesses per second. The popular advice "four random words is enough" was written for a 7,776-word list, where four words are 51.7 bits. The same rule does not carry over to a smaller list, which is why the default here is eight words and not four.
Example 2: eight words. 100^8 = 10^16 phrases, 53.2 bits. The table gives 5.8 days on average against the fast offline attack and 15,855 years against the throttled one. For a master password that must also survive an offline attack, ten words (66.4 bits) to twelve words (79.7 bits) is the sensible range with this list. All numbers above were recomputed with a short Node script using the same formula, n x log2(100), and they match the build-time table.
How the words are drawn, and what happens to your data
Each word index comes from crypto.getRandomValues, the browser's cryptographically secure random generator. The ordinary Math.random() is not used, because its output can be predictable and it is not designed for secrets. Turning a 32-bit random number into an index between 0 and 99 with a plain remainder would make the first few words very slightly more likely, because 2^32 is not an exact multiple of 100. The script avoids this with rejection sampling: random values above the largest multiple of 100 that fits in 32 bits are thrown away and drawn again, so every word has exactly the same probability. Words may repeat within one phrase, and they should: sampling with replacement is what makes the table above exact.
The script contains no network call, no storage call, and no logging; the phrase exists only in the page until you reload or close it. If the browser lacks crypto.getRandomValues, the tool refuses to generate anything instead of falling back to a weaker random source. What it cannot protect you from is your own environment: a screen share, someone looking over your shoulder, a malicious browser extension, or a clipboard manager that keeps history. After copying a phrase, paste it where it belongs and then copy something harmless over it.
Common mistakes and limits
Re-rolling until you like it. If you generate dozens of phrases and keep the one that is easiest to remember, you have quietly shrunk the search space. Use the first result, or add a word instead of re-rolling.Editing words by hand. Swapping a word you find awkward removes the randomness of that position, and substituting letters for symbols (a to @, o to 0) adds almost nothing because attackers try those substitutions first.Reusing one phrase everywhere. If any one site leaks it, every other account using it is exposed. Use a distinct phrase per important account, or let a password manager hold the rest.Expecting it to fit every form. The words are English and lowercase. Some sites cap the length, reject spaces, or demand a capital letter and a symbol; in that case pick another separator or use the Password Generator for a compact random string. This list is also small and public, which does not weaken a random draw but means you must rely on the word count, not on any secrecy of the list.
How to put the result to use
A practical routine for a new master password: generate a phrase, write it on paper once, type it from the paper for a few days until your fingers know it, then destroy the paper. If a separator keeps tripping you up, standardize on the hyphen. When you want a second opinion on any existing password, the Password Strength Checker shows a length-and-character-based estimate, although it will not know that your phrase was drawn from a word list. For scale: a fully random 8-character password from the 94 printable ASCII characters is about 52.4 bits and a 12-character one about 78.7 bits, so an 8-word phrase from this list (53.2 bits) is comparable to the former and a 12-word phrase (79.7 bits) to the latter.
Frequently Asked Questions
How many words should I use?
With the 100-word list here each word adds about 6.64 bits. For ordinary accounts that rate-limit logins, 6 to 8 words (about 40 to 53 bits) is a reasonable floor; for a password-manager master password or full-disk encryption, where an attacker may work offline, use 10 to 12 words (about 66 to 80 bits). The table above lets you match the count to your threat.
Why is the default eight words instead of four?
Because the list is small. Four words from 100 are only about 26.6 bits, and an offline attacker can exhaust that in well under a second. The "four words" rule of thumb applies to the 7,776-word Diceware list.
Is the generated passphrase stored or sent anywhere?
No. The script runs in your browser, uses no network request or storage, and the phrase disappears when you reload or close the page. Copying it puts it on your clipboard, though, so clear the clipboard afterwards if the device is shared.
Does adding a digit or a capital letter make it safer?
A random digit adds only about 3.3 bits. Capitalizing the first letter by habit adds almost nothing, because attackers try that variant early. The reliable way to add strength is one more random word, which adds 6.64 bits.
Is this the same thing as Diceware?
The idea is the same: concatenate randomly chosen words. The differences are that Diceware uses a 7,776-word list and physical dice, while this tool uses a 100-word list and the browser's secure random generator. Per word, this tool is about half as strong, so it asks you to compensate with more words.
Related tools
- Password Strength Checker - estimate the strength of a password you already use
- Password Generator - random characters with adjustable length and character types
- Hash Generator - see how a password turns into a hash
- UUID Generator - random identifiers