Skip to content
TextArray
100% local

Diceware passphrase generator

Generate strong, memorable passphrases from random words with a shown entropy figure.

Output
Related tools
Password generatorRandom generators
Password strength checkerRandom generators
Random word generatorRandom generators
Random string generatorRandom generators
Random emoji generatornewRandom generators
Passphrase generatornewRandom generators
Diceware passphrase generator
A passphrase of a few random words is the rare security advice that makes life easier, not harder: correct-horse-battery-staple is both far stronger than a mangled P@ssw0rd1 and far easier to remember. This generator builds those phrases the Diceware way — each word an independent, uniform draw from a list of over two thousand common English words, using the browser's cryptographic randomness. Because the draw is uniform and independent, the entropy is exact and shown with every batch: words × log₂(list size) bits, no hand-waving.
Six words from a 2000-word list is roughly 77 bits — comfortably past what any offline attacker will brute-force in a lifetime, and the default here. Drop to five for lower-stakes accounts, push to eight or more for a master password or an encryption key. The separator, letter case and an optional trailing digit are yours to set, mostly to satisfy password fields that demand a symbol or a number; none of that meaningfully changes the strength, which comes from the word count alone — the tool is honest about that in the entropy figure.
Generate a batch at once and pick the phrase that sticks in your head; the one you will actually remember is the one you should use. The words are common and easy to type, chosen to be spellable and phone-friendly, not obscure.
Everything runs locally in your browser using crypto.getRandomValues — the same randomness source as the password generator. The passphrases are created on your device, never transmitted, and nothing is logged; refresh and they are gone.
FAQ
Why is a passphrase stronger than a complex password?
Strength is entropy, and entropy comes from unpredictability, not from symbols. Six random words from a 2000-word list is ~77 bits; a typical 8-character "complex" password with substitutions is often under 40 bits and, worse, follows guessable patterns. The passphrase wins on both counts — and you can remember it.
How is the entropy calculated?
Each word is a uniform, independent pick from the list, so entropy is exactly words × log₂(list size). With a 2165-word list that is about 11.08 bits per word — six words give ~66.5 bits, eight give ~88.7. The figure shown is real, not an estimate.
Do the separator, case and digit make it stronger?
Barely. They exist to satisfy password rules that demand a symbol, a capital or a number. The security comes overwhelmingly from the number of words; the trailing digit adds only ~3.3 bits. Add more words if you want more strength.
Is the randomness safe to trust?
Yes. It uses crypto.getRandomValues, the browser's cryptographically secure random source, with rejection sampling so every word is equally likely — no modulo bias. Math.random is never used here.
Are the passphrases sent anywhere?
No. They are generated entirely in your browser, never transmitted or stored. Once you navigate away or refresh, they are gone — copy the one you want first.