Passphrase Generator
Builds a diceware-style passphrase from a word list, showing the entropy in bits.
A passphrase is for the handful of secrets you have to hold in your head and type on a keyboard you cannot paste into — a disk unlock, a device PIN screen, the master password of the manager that holds everything else. Words drawn at random from a known list are memorable in a way random characters are not, and the entropy is arithmetic rather than a guess.
…
Entropy
77.5 bits
Strength
Strong
Wordlist
7776 words
Length
0 chars
How long would it take to guess?
About 4 thousand years on average.
A stolen database hashed with unsalted MD5 or SHA-1, attacked on a rig of eight modern GPUs. This is the number to plan against, because you do not get to choose how a site stored your password. The figure is half the keyspace — 77.5 bits — divided by 1,000,000,000,000 guesses per second. It assumes the attacker knows exactly how this password was built and has no other way in; a password is rarely the weakest part of an account.
Every password here comes from crypto.getRandomValues in this tab. Nothing is sent anywhere, nothing is written to storage, and closing the tab is enough to be rid of it — there is no history to clear. The one place it does escape this page is your clipboard, which other applications can read; paste it into your password manager and copy something harmless afterwards.
How to use it
Choose the number of words
Each word from the EFF long list is worth 12.9 bits. Six words is the usual floor for something that must survive an offline attack; four is for a phrase that only ever faces a rate-limited login.
Pick a separator you can type
Hyphens and spaces are equivalent to the entropy; they matter only because some login screens strip one of them. Capitalisation and appended digits add almost nothing — the word count is what carries the strength.
Read the bit figure before you accept it
The bits shown are words × log₂(list size), which holds only because the words were drawn uniformly. If you reroll until you like the phrase, you are choosing rather than drawing, and the figure stops being true.
Common questions
Isn’t a phrase of real words easier to guess?
Only if the words came from a sentence. An attacker who knows the exact list and the exact word count still faces list-size-to-the-power-of-words possibilities — 7,776⁶ for six EFF words, about 77 bits. Secrecy of the list is not part of the strength.
Can I use it for website logins?
You can, but a random character string from the password generator is the better fit there because the manager types it for you and length limits are common. Save passphrases for what you type yourself.
Where does the word list come from?
The EFF long diceware list — 7,776 English words chosen so that no word is a prefix of another and none is easily confused when spoken or typed. It ships with the page; no request is made to fetch it.
Feed it from
Next
These accept what this tool produces, so the result can go straight in.
Entropy Meter
Measures the Shannon entropy of a string or file and shows a byte histogram — useful for spotting keys.
Password Generator
Generates random passwords with length, character set and ambiguous-character rules, in bulk if needed.
Password Strength Meter
Estimates how long a password would take to crack, naming the patterns that weaken it.
Suspicious URL Check
Inspects a link’s shape before you open it — lookalike characters, IP-literal hosts, @ tricks, deep subdomains, odd ports, shorteners — and on request traces its redirects and looks up the domain’s registration date. No reputation database.
Audio Converter
Converts between MP3, WAV, FLAC, AAC, OGG and Opus with bitrate and sample-rate settings.
Base64 Encoder & Decoder
Encodes and decodes Base64 and Base64URL for text or files, handling UTF-8 correctly.