Random Passphrase Generator
Generate strong, memorable passphrases from a built-in word list with entropy display.
Sobre esta ferramenta
Passphrases are easier to remember than random character passwords and can be just as secure. This generator uses a built-in list of 1,000 common English words to build phrases you can actually recall. Choose 3 to 8 words, pick a separator (space, dash, dot, or underscore), optionally capitalize the first letter of each word, and optionally append a random digit and special character. Each generation produces five candidates at once. Entropy bits and estimated crack time are displayed for every phrase.
Como usar
- 1 Choose the number of words (3–8).
- 2 Select a word separator.
- 3 Toggle capitalization, number, and symbol options.
- 4 Click 'Generate' to create five passphrases at once.
- 5 Click any passphrase to copy it to your clipboard.
- 6 Check the entropy and estimated crack time shown below each phrase.
Why a passphrase can beat a password
A passphrase strings together several ordinary words — harbor-velvet-engine-cloud — instead of jamming random symbols into a short string. The appeal is that a human can actually remember four words, yet the security comes from the same place a random password's does: the sheer number of possibilities an attacker must search. The trick is that the words must be chosen randomly. A phrase you compose yourself from a memorable sentence is weak, because attackers model natural language and guess likely word sequences first. This generator instead draws each word independently from a fixed list of 1,000 common English words, so there's no sentence structure for a cracker to exploit.
Entropy, and exactly how it's counted here
Strength is measured in bits of entropy — every bit doubles the number of guesses required. When each word is picked uniformly from a pool of 1,000, each word contributes log₂(1000) ≈ 9.97 bits. The total for a plain phrase is simply the per-word bits times the word count:
| Words | Approx. entropy | Rough strength |
|---|---|---|
| 3 | ≈ 30 bits | Weak |
| 4 | ≈ 40 bits | Fair |
| 5 | ≈ 50 bits | Strong |
| 6 | ≈ 60 bits | Strong |
| 7 | ≈ 70 bits | Very strong |
| 8 | ≈ 80 bits | Very strong |
The optional extras add a little more: appending a number 0–99 adds log₂(100) ≈ 6.6 bits, and appending one of the nine symbols adds log₂(9) ≈ 3.2 bits. Crucially, capitalising the first letter of each word and choosing a separator add no entropy in this model, because those choices are fixed by your settings, not random — they make the phrase easier to type and read, not harder to guess.
How the crack-time estimate works
Below each batch, the tool converts entropy into an estimated crack time by assuming a fast offline attacker trying 10¹² (one trillion) guesses per second — roughly a serious GPU cluster against a weak hash. Time equals 2^bits ÷ 10¹². A 4-word phrase (~40 bits) gives about 2⁴⁰ ≈ 1.1 trillion guesses, or roughly a second at that rate — which is why four words is only a "fair" minimum. A 6-word phrase (~60 bits) is about 2⁶⁰ ≈ 1.15 × 10¹⁸ guesses, which at a trillion per second is over 36,000 years. Each extra word multiplies the attacker's work by 1,000, so the jump from five to six words is the single biggest lever you have.
A worked example
Set the word count to 5, keep capitalisation on, add a number, and add a symbol. You might get Velvet-Harbor-Engine-Cloud-River-47!. Entropy is 5 × 9.97 + 6.6 + 3.2 ≈ 59.6 bits, landing in the "Strong" band. Generate again and you get five fresh candidates at once, so you can pick the one that's easiest for you to remember — a small but real usability win, since a phrase you'll actually recall beats a marginally stronger one you'll write on a sticky note.
An honest note on the randomness
This generator draws words using the browser's standard Math.random() function. That's fine for generating memorable, high-entropy phrases for everyday accounts, and the entropy figures above hold as long as each word is independently selected. But Math.random() is not a cryptographically secure generator, so for the very highest-stakes secrets — a password manager's master key, an encryption key protecting irreplaceable data — prefer a tool built on the Web Crypto API or a physical Diceware roll. For typical logins, a five- or six-word phrase from here is far stronger than the password most people actually use.
Using passphrases well
- Four words is a floor, not a target. Use five or more for email, banking, and any account that can reset your others.
- Never reuse one. The biggest real-world threat is credential stuffing — a phrase leaked from one site tried everywhere else. A unique phrase per account contains the damage.
- Store the rest in a manager. Memorise only the handful of phrases that unlock everything else; let a password manager hold the long tail.
- Don't "simplify" a generated phrase. Swapping in a word that means something to you reintroduces a pattern an attacker can guess.
- Pair it with two-factor authentication. Even a strong phrase can be phished; a second factor blocks a stolen one from being enough.
The 1,000-word list is embedded directly in the page and every phrase is built on your device — nothing is transmitted or stored. You can confirm this by going offline; the generator keeps working.