Passphrase Generator

What is a passphrase generator?

A passphrase generator strings together several random words instead of random characters, on the theory that a phrase you can actually memorize protects you as well as a password you'll never remember and end up writing down. This one draws each word from the EFF long wordlist, 7,776 words published by the Electronic Frontier Foundation in 2016 and released under CC BY 3.0 US, curated specifically for passphrases: no word is a prefix of another, and the list avoids words that are easy to mishear or mistype.

7,776 is exactly 6^5 — the number of outcomes from rolling five dice, which is how the EFF originally intended people to pick words by hand. Every word carries exactly 12.9248 bits of entropy, and because the draw uses the browser's crypto.getRandomValues rather than Math.random(), each of the 7,776 words is exactly as likely to come up as any other.

How to use it

1. Choose how many words. Type a number or use the slider from 3 to 12 words; 6 is the default and the sweet spot between memorable and strong.
2. Pick a separator. Choose Hyphen (-), Period (.), Underscore (_), Space or None to join the words — hyphens read cleanly and are accepted almost everywhere a password can be typed.
3. Add capitals or a digit if a site demands them. Tick Capitalize each word or Add a number, then Copy the result — it redraws instantly whenever you change a setting, or press Generate again for a fresh phrase.

Where the strength actually comes from

Here's the single fact worth taking away from this page: a six-word passphrase carries 77.5 bits of entropy, slightly more than a twelve-character random password built from lowercase, uppercase, digits and symbols, which comes in at 76.5 bits. One is a jumble you'd never recall without writing down; the other you can read once and repeat back. At a trillion guesses a second — what an offline attacker gets against a badly hashed database — both take centuries to crack, but only one of them survives being memorized instead of stored.

Each of the 7,776 words in the EFF long wordlist is worth 12.9248 bits, so every extra word you add is worth more than either of the optional extras below. Capitalize each word adds exactly zero bits of entropy — it's the same transformation applied every time, so it rules out no possibilities, and any attacker's word list gets capitalized right along with yours. It exists purely because some login forms insist on a capital letter, not because it makes the phrase harder to guess.

Add a number is more useful, but modest: the digit lands on a randomly chosen word rather than the end of the phrase, which is worth log2(10 x 6) = 5.9 bits at six words, versus 3.3 bits if it were pinned to the end. Either way, that's less than half of the 12.9 bits a seventh word would buy. If a site lets you choose, adding a word beats adding a digit every time.

Why is it free?

Everything above happens in this browser tab — the word list is bundled with the page, so there's no server picking your words, no account, no export gated behind a plan. FreeToGenerate.com doesn't need to see your passphrase to generate it, and a tool that can't see it can't leak it, sell it or lose it in a breach.