What is the diceware method and why does xkcd recommend it?

Diceware is a method invented by Arnold Reinhold for generating passphrases by rolling dice and picking words from a list. Each of the six dice faces gives 6 outcomes, so 5 dice rolls select 1 of 6^5 = 7,776 words — each word carrying log2(7776) ≈ 12.9 bits of entropy. The popular xkcd comic 936 (correct horse battery staple) made the point that people choose passwords that are hard for humans to remember but easy for computers to guess. Four random dictionary words create ~51.6 bits of entropy — far stronger than a typical human-chosen password — while being genuinely memorable. BetterPass replaces the dice with crypto.getRandomValues() , a cryptographically secure random source, but the math is identical.

How do the random-digits separators work?

The Random digits separator places a random digit (0-9) between each word or syllable, producing passphrases like cat7brick3apple9garden . This is ideal for sites that require a number but forbid or limit special characters. Because the digit is drawn independently for every gap, each separator adds roughly 3.3 bits of entropy per gap on top of the word selection.

Is the passphrase generator free and private?

Yes. Passphrase generation happens entirely in your browser using crypto.getRandomValues() — the same CSPRNG that powers TLS connections. The EFF large wordlist (7,776 words) is bundled locally in the page, so word selection happens without any network requests. Your generated passphrase is never transmitted — no input data is sent over a network.

Secure Passphrase Generator — Easy to Remember, Hard to Crack

Generate Diceware-style word passphrases or pronounceable syllable passwords right in your browser — with batch generation, duplicate re-roll, and on-device history. Nothing ever leaves your device.

Click Generate...

Entropy

51.7 bits

Words

4 words

Crack Time

42 days

Word Pool

7,776

Generation mode

Selects random words from a curated word list. Each word contributes ~12.9 bits of entropy.

Customize your passphrase

Number of words4

More words increase security but may reduce memorability.

Quantity1

Separator

Pick a character to join your words or syllables — random digits are handy when a site requires a number but forbids symbols.

Save history

Options

Capitalize units

Append number

Append symbol

What is Passphrase Generator?

xkcd put it best: "Through 20 years of effort, we've successfully trained everyone to use passwords that are hard for humans to remember, but easy for computers to guess." A passphrase generator solves this by creating passwords from randomly selected words — producing long, memorable strings that are extremely resistant to brute-force attacks.

Long by design — even 4 random words create a passphrase with ~50+ bits of entropy; 6 words exceeds 75 bits.

Easier to remember — "correct-horse-battery-staple" is far more memorable than "k$9Lm#2xP!qR".

Diceware-inspired — rolls dice to pick random words from a list (this is called the Diceware method), combined with cryptographic randomness.

Pronounceable mode — generates CV-pair syllable passwords (e.g. fuxo-kewi-nuzo) that are easy to say aloud when words feel too long.

EFF Large word list — the full 7,776-word EFF list for maximum entropy per word.

Flexible separators — hyphens, underscores, spaces, dots, or random digits between units.

Local history — the last 25 generated passphrases are stored locally for quick reuse.

Zero-Server Tool Data Guarantee

All passphrases are generated entirely in your browser using the Web Crypto API. History is stored only in your browser's localStorage. No passphrase is ever sent to any server.

How to Use

Pick a Mode

Choose 'Words' for diceware-style passphrases or 'Pronounceable' for CV-syllable passwords you can say aloud.

Select Unit Count

Words: 4-6 for most accounts, 6-7 for high value. Syllables: 8-12 for comparable strength.

Pick a Separator

Hyphens, underscores, spaces, dots, none, or random digits to satisfy sites that require a number.

Add Extra Security

Optionally capitalize units and append a random number and/or symbol to meet complexity requirements. Note: the entropy number shown reflects the word/syllable count only — these options add complexity that is not counted in that number.

Generate in Bulk

Set the quantity above 1 to generate multiple passphrases at once, then copy all or export as TXT.

Reuse from History

Your last 25 generated passphrases are saved locally. Re-copy one anytime, or clear the history with one click.

Common Use Cases

Master Password

Create a strong, memorable master password for your password manager that you can recall without writing down.

Wi-Fi Password

Generate a passphrase for your home or office Wi-Fi that guests can easily type and remember.

Encryption Key

Use a 6+ word passphrase as the basis for an encryption key for sensitive files or databases.

Shared Account Access

Create a passphrase that team members can remember and type without needing a password manager.

Restrictive Sites

Use 'random digits' separators or pronounceable mode for sites that reject symbols or have odd length limits.

Implementation Examples

JavaScriptDiceware-Style Generation

// Word list should be at least 7776 words (6^5) for proper entropy
const WORD_LIST = ['apple', 'bridge', 'castle', /* ... 7775+ words */];

function generatePassphrase(wordCount = 5, separator = '-') {
    const array = new Uint8Array(wordCount);
    crypto.getRandomValues(array);
    return Array.from(array, 
        b => WORD_LIST[b % WORD_LIST.length]
    ).join(separator);
}

const passphrase = generatePassphrase(6, '-');
// "correct-horse-battery-staple-jump-wire"

Generation Modes

Mode	Unit	Pool Size	Bits / Unit	Best For
Words (EFF Large)	1 word	7,776	12.9	Maximum security
Pronounceable	1 CV pair	100	6.6	Sayable passwords

Production Best Practices & Security

Use 6–7 words for strong security — this provides ~78–91 bits of entropy (5 words provides only ~65 bits). Why:Each additional word increases the total combinations exponentially. A 6-word passphrase is thousands of times harder to crack than a 4-word one.

Use 8–12 syllables in pronounceable mode — each CV pair contributes ~6.6 bits, so 8 syllables ≈ 53 bits and 12 ≈ 80 bits. Why:Pronounceable passwords trade a little entropy per character for memorability and typeability — compensate with more syllables.

Add numbers/symbols for compliance — if your system requires special characters, toggle the extra options. Why:Many websites have outdated password policies that require symbols or numbers even for long passphrases. The 'random digits' separator can satisfy a numeric requirement without adding symbols.

Don't share passphrases verbally in public — even though they're "sayable," avoid speaking them in insecure environments. Why:Passphrases are easier to overhear and remember than random characters. If you speak one out loud, anyone nearby could potentially steal it.

Use unique passphrases per service — don't reuse the same passphrase across multiple accounts. Why:Credential stuffing is a common attack. If one service is compromised, attackers will try your passphrase on every other major platform.

Store in a password manager — even memorable passphrases should be stored securely, not written on sticky notes. Why:While you might remember your master passphrase, you shouldn't rely on memory for dozens of different accounts. A password manager provides a single, encrypted source of truth.

Clear your local history — history is stored in plaintext on your device; clear it regularly. Why:Anyone with access to your browser profile could read saved passphrases. Treat local history like a temporary scratchpad, not a vault.

Frequently Asked Questions

Passphrases solve the fundamental tension in password security: length versus memorability.

A 4-word passphrase like correct horse battery staple (made famous by the xkcd comic) is both easier to remember and harder to crack than a typical 8-10 character password. While a random 12-character password has about 71–79 bits of entropy depending on the character set, a 5-word passphrase from a 7776-word dictionary has about 65 bits — comparable security with far better human recall.

Passphrases are ideal for password manager master passwords, encrypted drive passphrases, and any scenario where you must remember the secret yourself.

Pronounceable mode builds passwords from consonant-vowel (CV) pairs — for example fuxo-kewi-nuzo. Each syllable is one consonant followed by one vowel, so the result is naturally readable and easy to say aloud.

With 20 consonants and 5 vowels, each CV pair draws from a pool of 100 combinations, contributing log2(100) ≈ 6.6 bits of entropy. An 8-syllable pronounceable password therefore has ~53 bits — comparable to a 4-word diceware passphrase — while remaining easy to type and dictate.

This mode is a good middle ground when a site rejects symbols but you want something more sayable than a random character string.

Passphrase entropy is calculated as log2(pool_size^unit_count). With the EFF large wordlist (7,776 words), each word contributes about 12.9 bits; in pronounceable mode each CV pair contributes about 6.6 bits.

A 4-word passphrase gives ~51.6 bits, 5 words ~64.6, 6 words ~77.5. As a rule of thumb: 50-60 bits is adequate for most uses, 60-70 bits is strong, and 80+ bits is extremely secure. The tool shows the exact entropy so you can adjust the word count to meet your needs.

Yes. Set the Quantity above 1 to generate up to 100 passphrases in a single batch. Every entry is produced independently with crypto.getRandomValues().

Use Copy all to copy every passphrase to the clipboard, Re-roll duplicates to make each entry unique, or Export as TXT to download them as a text file (one per line). The batch results also detect duplicate entries so you never accidentally reuse a passphrase.

Your last 25 generated passphrases are saved to your browser's localStorage — they never leave your device. History keeps the first passphrase from each generation for quick re-copying.

Because history is stored in plaintext, clear it regularly using the Clear button in the history panel. It behaves like a temporary scratchpad, not a vault — a dedicated password manager remains the right home for your long-term credentials.