Passphrase Generator (Diceware Style)
Create strong, memorable passphrases from the EFF diceware word list.
About 77.5 bits of entropy
Words from the EFF Large Wordlist (7,776 words), used under CC BY 3.0.
Use via API
Random diceware-style passphrases from the EFF large word list (7,776 words), chosen with a cryptographic random source, with their entropy in bits. Send JSON, get JSON back.
POST https://pithlab.com/api/v1/tools/passphrase-generator
curl https://pithlab.com/api/v1/tools/passphrase-generator \
-H "Authorization: Bearer $PITHLAB_KEY" \
-H "Content-Type: application/json" \
-d '{"words":5,"separator":"hyphen","count":2}'About the Passphrase Generator
Generate memorable diceware-style passphrases from the 7,776-word EFF list using secure randomness. Pick words, separator and extras. Runs in your browser.
How to use the Passphrase Generator
- Choose how many words you want. Six words from the EFF list gives about 77 bits, which is strong for most uses.
- Pick a separator such as a hyphen or space, and tick Capitalise or Add a digit if a site insists on them.
- Press Generate until you get a passphrase you like, then Copy it into your password manager.
Examples
Input
6 words, hyphen separator
Output
e.g. flint-trace-rehire-player-uniquely-reverse (77.5 bits)
Input
4 words, dot separator, capitalise, add a digit
Output
e.g. Equity.Shopper.Throttle7.Cleat (55.0 bits)
Frequently asked questions
Where do the words come from?
The tool uses the EFF Large Wordlist by the Electronic Frontier Foundation (eff.org/dice), 7,776 words chosen to be easy to spell and remember. It is used under the Creative Commons Attribution 3.0 licence (CC BY 3.0).
How is the entropy figure worked out?
Each word is picked uniformly from 7,776 words, which is log2(7776), about 12.9 bits per word. Six words gives about 77.5 bits. Add a digit adds log2(10), about 3.3 bits. Capitalising and the separator add nothing because we assume an attacker knows your settings.
Is this as random as rolling real dice?
Yes. Words are chosen with the Web Crypto API (crypto.getRandomValues) using rejection sampling, so every word is equally likely, just like rolling five fair dice per word. The passphrase is generated on your device and never sent anywhere.
How many words should I use?
Five words (about 65 bits) is reasonable for most online accounts. Use six or seven words for a password manager master password or disk encryption, where an attacker could guess offline.
Should I use no separator?
Separators make passphrases easier to read and type. With no separator, a few word combinations can run together ambiguously, which costs a tiny amount of entropy, so a hyphen or space is usually the better choice.