Diceware passphrase generator
What is a Diceware Passphrase Generator?
A Diceware passphrase is a sequence of randomly chosen common words, such as correct-horse-battery-staple style phrases. Because the words are chosen randomly from a large list, passphrases are very strong yet much easier to remember and type than random character passwords. This generator creates them with your chosen number of words and separator.
How to use it
- Choose how many words, 6 or more for important accounts.
- Choose a separator such as a space, hyphen or period.
- Generate and copy the passphrase, then store it in your password manager.
How strong is it?
The classic Diceware list has 7,776 words, one for each result of rolling five dice. Each word adds log2(7776) = 12.9 bits of entropy.
- 4 words: about 51.7 bits
- 5 words: about 64.6 bits
- 6 words: about 77.5 bits, a good choice for master passwords
- 7 words: about 90.5 bits
At 77.5 bits, an attacker guessing a trillion times per second would need on average more than two thousand years to find it. The strength comes from the randomness of selection, not from the words being obscure.
Rules for real security
- Do not change the words or choose your favourites; human choice destroys the randomness.
- Use a new passphrase for each important account, and a password manager for the rest.
- Extra capital letters or symbols add little; an extra word adds far more.
Words are selected with the browser's cryptographically secure random generator and never leave your device.
Frequently Asked Questions
How many words should a Diceware passphrase have?
At least 6 words for important passwords such as a password manager master password. 5 is acceptable for less critical accounts.
Is a passphrase stronger than a complex password?
A 6-word random passphrase has about 77 bits of entropy, stronger than a typical 12-character random password, and much easier to remember.
Can I pick the words myself?
No. The security depends on words being chosen randomly. Human choices are predictable.
Is the passphrase generated securely?
Yes. It uses the browser's cryptographically secure random generator and is never sent anywhere.