Diceware passphrase generator
Build memorable diceware passphrases from a 1,024-word list, with separators, capitalisation and the exact entropy in bits. Fully offline in your browser.
- Runs in your browser
- Nothing you enter is sent
- Free, no account
Nothing leaves this tab. The 1 024-word list is embedded in the page, the words are picked by your browser’s crypto.getRandomValues, and the finished passphrase is never sent, logged or stored anywhere.
Fine for low-value accounts, not for email, banking or a password manager.
10.00 bits/word × 5 words = 50.00 bits
Four words is the usual minimum; six or more if it protects a password manager, a disk or a backup.
Appends one random digit to one random word — worth 5.6 bits, and satisfies “must contain a number” rules.
Appends one character from !@#$%&*?+-= to one random word — worth 5.8 bits.
Up to 50 at once.
| Attack | Assumed rate | Average time to crack |
|---|---|---|
| Online, rate limited | 100 guesses per hour — a login form that locks out after repeated failures | 642 million years |
| Online, no throttling | 1 000 guesses per second — credential stuffing against an unprotected API | 18 thousand years |
| Offline, slow hash | 20 000 guesses per second — bcrypt or PBKDF2 on a rented GPU box | 892 years |
| Offline, fast hash | 100 billion guesses per second — unsalted SHA-1/MD5 on an eight-GPU rig | 2 hours |
Kerckhoffs’s principle: the security comes from the randomness of the choice, not from keeping the list secret. That is why the whole list is downloadable — you can verify it has 1 024 entries and that each word therefore carries exactly 10 bits.
How to generate a passphrase
- Choose how many words. Five is a good default. Four is acceptable for something behind a rate-limited login; six or more for a password manager, a laptop disk or a backup archive that an attacker could copy and grind at their leisure.
- Pick a separator. Hyphens keep the phrase readable and are accepted almost everywhere. Spaces are more natural to type but some login forms silently strip them.
- Add a digit or symbol only if a form demands it. The tool shows exactly how many bits each option is worth so you can see it is a compliance feature, not a security one.
- Regenerate until you get one you can picture. This is the only step where human judgement helps, and it costs nothing: rejecting phrases you dislike does not meaningfully reduce entropy as long as you are not filtering for a pattern.
- Write it down while you learn it. A passphrase you have not memorised yet and cannot retrieve is worse than a slightly weaker one you can. Paper in a drawer is a perfectly good threat model for most people during the first week.
Why passphrases work
Human memory is good at words and terrible at character salad. A passphrase exploits that: it buys entropy through length in words rather than complexity in characters. The catch is that the words have to be chosen by a machine. A phrase you invent yourself — a song lyric, a saying, a sentence about your dog — carries almost no entropy, because natural English is highly predictable and attackers have been building phrase dictionaries for years.
This tool draws each word independently and uniformly from a list of exactly 1,024 words, so each word contributes precisely log2(1024) = 10 bits. The arithmetic is unusually clean:
| Words | Entropy | Possible phrases | Slow hash (20k/s) | Fast hash (100 G/s) |
|---|---|---|---|---|
| 3 | 30 bits | 1.1 billion | 7 hours | under a second |
| 4 | 40 bits | 1.1 trillion | 10 months | 5 seconds |
| 5 | 50 bits | 1.1 quadrillion | 892 years | 2 hours |
| 6 | 60 bits | 1.2 quintillion | 913 thousand years | 2 months |
| 7 | 70 bits | 1.2 sextillion | 935 million years | 187 years |
| 8 | 80 bits | 1.2 septillion | 958 billion years | 192 thousand years |
The "fast hash" column is the sobering one. If a site stores your password as an unsalted SHA-1 — and plenty of breached sites did — four words falls in seconds. That is why six words is the recommendation for anything protecting other secrets.
Diceware, and why this list has 1,024 words
The original Diceware list, published by Arnold Reinhold in 1995, has 7,776 entries because that is 65 — five throws of a physical die select a word with no arithmetic. Each word is worth 12.9 bits. This tool has no dice to accommodate, so the list is sized at 210 instead, which makes each word worth exactly ten bits and the total entropy trivially checkable in your head: five words, fifty bits.
The words themselves are ordinary English, three to eight lowercase letters, with no apostrophes, no accents, no plural-and-singular pairs and nothing easy to mishear when read out loud. You can download the complete list from the tool above and count it yourself.
Common mistakes
- Choosing the words yourself. "Correct horse battery staple" is famous, and therefore in every wordlist on the internet. So is any phrase you thought of because it felt random.
- Rejecting phrases until one "sounds right". Filtering for grammatical phrases collapses the search space dramatically. Rejecting one or two because they are hard to type is fine; rejecting fifty until you get a sentence is not.
- Assuming capitalisation adds strength. Capitalising the first letter of each word is a rule, and rules are the first thing an attacker applies. The tool reports zero extra bits for it, honestly.
- Reusing the passphrase. A 60-bit passphrase used on ten sites is only as safe as the least careful of those ten.
Where a passphrase is the right choice
Use one wherever you have to type the secret from memory: your password manager's master password, a full-disk encryption key, a laptop or phone login, an SSH key passphrase, a recovery phrase for a backup archive. For everything else — the hundreds of site logins you never type by hand — let the password manager generate long random strings instead. Memorable is a cost you should pay only where memory is actually required.
Questions
How many words do I actually need?
With this 1,024-word list each word is worth exactly 10 bits, so four words give 40 bits, five give 50 and six give 60. Four is enough for something rate-limited, five or six for a password manager, a disk or a backup that an attacker could take away and grind offline.
Does it help to keep the word list secret?
No, and assuming it does is a classic mistake. The strength comes from the randomness of the selection, not from hiding the list — Kerckhoffs’s principle. That is why the entire list is downloadable here: you can count it, confirm it holds 1,024 entries and confirm the 10-bits-per-word claim yourself.
Why is a passphrase better than a mangled word?
Because "P@ssw0rd!" is one dictionary word plus a handful of substitutions a cracker applies automatically — roughly 15 bits of real strength. Five unrelated words drawn at random are 50 bits and, unlike the mangled word, you can actually remember them.
Do capital letters make it stronger?
Not by itself. Capitalising the first letter of each word is a rule, not a random choice, so an attacker simply applies the same rule. It is offered because some login forms demand a capital, not because it adds entropy — the bits shown on the page reflect that honestly.
Can I type the separator I want?
Yes. Hyphens, spaces, dots, underscores, nothing at all, or a custom string. The separator does not add entropy either, since the attacker knows the convention, but hyphens keep the phrase readable and spaces are rejected by some forms.