Overview
Random symbols make strong passwords that nobody can remember, which is why people write them down or simplify them — defeating the point. A passphrase takes the other road: several unrelated words in a row. Four or five ordinary words are easy to hold in memory and type on a phone, yet the number of possible combinations is enormous, provided the words were truly picked at random. That's the job this tool does, drawing each word with your browser's cryptographic random source instead of letting habit choose.
You shape the result to fit the site you're joining. Pick between three and eight words, choose the character that joins them — hyphen, underscore, space or dot — decide whether each word gets a capital letter, and optionally add a random digit at the end for sites that demand one. Every change redraws the passphrase instantly and updates the entropy estimate, so you can watch what each extra word is worth.
What is a passphrase?
A passphrase is a password made of whole words instead of scattered symbols. Its strength doesn't come from looking complicated — it comes from arithmetic. If each word is drawn fairly from a list of, say, 150 candidates, every word multiplies the total possibilities by 150. Four words give hundreds of millions of combinations; six words push the count beyond anything casual guessing can reach. Longer phrases also tend to satisfy minimum-length rules easily.
The critical condition is that the words must be genuinely random. A line from a song, a famous quote, or your street name followed by your dog's name feels personal but is exactly what attackers try first — those combinations live in their dictionaries. Let the generator choose, and don't swap a word just because another 'feels luckier.' That feeling is bias, and bias is precisely what randomness is there to remove.
Features
- Three to eight words. Set the count with a slider or number box to match the rules of wherever you're signing up.
- Four separator styles. Hyphen, underscore, space or dot — pick whichever the destination site accepts.
- Optional capitalisation. Start every word with a capital to satisfy 'must contain uppercase' requirements.
- Optional trailing digit. A random number tacked on the end for sites that insist on having one.
- Live entropy estimate. See the bit count and strength label update with every option you change.
- Instant regeneration. A fresh phrase appears the moment you touch any setting; the copy button grabs it in one click.
- Plain, spellable word list. Around 150 common English words — nothing obscure you'll mistype on a small keyboard.
Benefits
- Memorable by design. Familiar words stick after a few uses — ideal for master passwords you type from memory.
- Easy to type anywhere. Words are far less error-prone on phones, TV remotes and shared keyboards than symbol soup.
- Honest strength maths. The entropy readout shows what each word adds, so there is no guesswork.
- Nothing leaves your device. Words are drawn locally; no server ever sees your passphrase.
Who can use it
Anyone who needs a strong secret they'll occasionally type by hand. The classic case is the master password for a password manager, a laptop login, or a Wi-Fi key you read out to guests — places where symbols become a liability. It's also kinder for people who find tangled passwords hostile: older relatives, kids setting up their first accounts, or teams sharing a credential that must be spoken over a call. If a password will ever pass through a human mouth or human fingers, a passphrase is usually the right shape.
How to use
- Choose how many words you want — four is fine for ordinary accounts, five or six for anything important.
- Pick a separator the site accepts; hyphens are the safest default.
- Switch on capitalisation if the site requires an uppercase letter, and add the trailing number if it demands a digit.
- Read the entropy estimate and aim for a 'strong' or 'very strong' label on accounts that matter.
- Press 'Copy passphrase', paste it where it belongs, and store it in your password manager — a different one per account.
Frequently asked questions
Why use words instead of random symbols?
Because the strongest password is the one you actually keep using. Symbol-heavy passwords get written on sticky notes, simplified after three failed logins, or reused — all of which destroy their strength. A phrase of random words is pleasant to type and remember, so it survives contact with real life. And the maths holds up: five random words from a 150-word list carry more entropy than most eight-character passwords people actually choose.
How many words do I really need?
Four words beat the vast majority of human-invented passwords and suit low-stakes accounts. Five words are a sensible default for daily use. Six words land you in very strong territory, appropriate for your email, password manager, or anything protecting money. Beyond six, you're adding memorisation burden for little practical gain. Match the count to what the account guards — and whatever you choose, never reuse the phrase elsewhere.
Can I just make up my own phrase?
You can, but it won't be as strong as you think. Human-chosen phrases follow grammar, rhythm and personal meaning — song lyrics, quotes, family references — and cracking tools model all of that. Studies of leaked passwords show people are strikingly predictable. The generator's advantage is that it has no taste and no memories; every word is an independent random draw. If you want a personal touch, let the tool generate first, then only regenerate — never hand-edit.
Which separator should I pick?
Hyphens are the safest choice — almost every system accepts them. Underscores are nearly as safe. Dots work in most places but a few older systems choke on them. Spaces are the most readable for humans but the least accepted by software, so only use them where you're sure they're allowed. When in doubt, hyphen. The separator barely affects strength, so this is purely a compatibility decision.
Is a passphrase safe enough for important accounts?
A five- or six-word random passphrase is strong enough for nearly anything, including email and financial accounts — provided it's unique to that account and stored in a password manager. Pair it with two-factor authentication wherever offered; no password alone should be your only defence on a high-value account. Never share one over email or chat, and give every important account its own unique phrase.
Does this page see or store my passphrase?
No. The words are drawn inside your browser using its cryptographic random source, and the phrase never travels over the network. Nothing is logged, no account is needed, and refreshing the page wipes it completely. That's why you should copy the passphrase into a password manager before you leave — once it's gone from your screen, even we can't get it back.
Conclusion
When a password has to live in your head, words beat symbols. Let the generator draw them fairly, take five or six for anything that matters, and you get a secret that's pleasant to type and tedious to attack. Store it in a manager, never reuse it, and you've solved the memorability problem without giving up real strength.