Diceware Passphrase Generator
Memorable, high-entropy passphrases from the EFF wordlist — with live entropy and crack-time estimates.
Words
6 words (≈ 77.5 bits) beats most password policies; 7+ for high-value accounts.
Separator
Extras
How this works
- Each word is picked from the EFF long wordlist (7,776 words) using your browser’s cryptographic random generator with rejection sampling — every word is equally likely, with no modulo bias.
- Nothing leaves your device: the wordlist is embedded in the page and generation happens 100% locally.
- Wordlist by the Electronic Frontier Foundation (eff.org/dice), used under CC BY 3.0. “Diceware” is Arnold Reinhold’s method for memorable passphrases; this is an independent diceware-style implementation, not affiliated with or endorsed by him.
Diceware passphrase generator online free (memorable, strong passwords)
The strongest password is the one you can actually remember — and the one you never reuse. Random strings like “J7#qL9!vX2@” look secure, but humans cannot memorize them, so they get written on sticky notes, reused across sites, or quietly weakened into predictable patterns. Diceware-style passphrases solve this differently: six random words — “correct horse battery staple” is the famous example — that your brain can hold onto while remaining brutally hard for computers to guess.
This free generator picks words from the EFF long wordlist of 7,776 words using your browser’s cryptographic random source, with rejection sampling so every word is equally likely. Choose 4–10 words, pick a separator, optionally satisfy “must contain a number” rules — and watch the live entropy meter and crack-time estimate update as you go. Everything happens locally; your passphrase never leaves the tab.
Why passphrases beat complex gibberish
Password strength is measured in entropy — roughly, how many guesses an attacker needs on average. Each EFF word contributes about 12.9 bits (because log₂(7776) ≈ 12.9), so six words give ≈ 77.5 bits: about 2⁷⁷ combinations. A 12-character random password with mixed symbols has only ≈ 71 bits. The passphrase wins on math and on human factors: you can type it without looking, dictate it over the phone, and remember it after a weekend away.
- Memorable: words form mental images; random symbols do not. You will actually use a unique passphrase per site instead of reusing one “clever” password everywhere.
- Typable: no squinting at similar characters (is that a 1, an l, or an I?). Words survive handwriting, dictation, and mobile keyboards.
- Honest strength: the entropy display shows exactly what you get — no marketing, no “password strength bars” based on vibes.
How many words do you need?
It depends on what the passphrase protects. The crack-time estimate assumes an attacker trying a trillion guesses per second — far beyond what any online login allows, but realistic for stolen password hashes.
- 4–5 words (≈ 52–65 bits): fine for low-stakes accounts with rate-limited logins. Better than any human-invented password.
- 6 words (≈ 77.5 bits): the recommended default. Resists offline attacks for centuries at current capabilities.
- 7–10 words (≈ 90–129 bits): for your password manager’s master password, disk encryption, or anything you never want to change. Ten words is overkill today — which is exactly the point for long-lived secrets.
Generate a passphrase in 3 steps
- Pick your word count. Six is the default and suits most accounts. Slide up for vault-grade secrets.
- Choose a separator and extras. Spaces read most naturally; hyphens survive systems that dislike spaces. Toggles add a digit or symbol only if a site’s rules demand them.
- Copy it and store it. Put the passphrase in a password manager. Generate a fresh one per site — uniqueness matters more than squeezing out extra bits.
About the wordlist (attribution)
The 7,776-word list is the EFF long wordlist by the Electronic Frontier Foundation (eff.org/dice), used under CC BY 3.0. It was designed for exactly this purpose: short, distinctive, easy-to-type words. “Diceware” is Arnold Reinhold’s method for memorable passphrases; this tool is an independent diceware-style implementation and is not affiliated with or endorsed by him.
Your passphrase never leaves this page
Generation uses crypto.getRandomValues — the same cryptographic source browsers offer to web apps — with rejection sampling to eliminate modulo bias. The wordlist ships inside the page, so there is no server to trust, no network request to intercept, and nothing logged. Close the tab and the passphrase is gone from memory.
Pro tip: pair with a password manager
Use a memorable passphrase for the few secrets you must type — your manager’s master password, your laptop login — and let the manager handle the rest. For machine-only secrets like API tokens, our Password Generator or database-friendly UUID v7 Generator are the better fit.
FAQs
What is a diceware passphrase?+
It is a password made of several random words picked from a fixed wordlist — for example “correct horse battery staple”. Because each word is chosen independently from 7,776 possibilities, a 6-word passphrase has about 77.5 bits of entropy: enormously strong, yet far easier to remember and type than random gibberish.
Is a passphrase really as strong as a random password?+
Yes, when the words are truly random. Strength comes from entropy — the number of guesses an attacker needs — not from looking complicated. A 6-word EFF passphrase (≈ 77.5 bits) is stronger than a typical 12-character random password (≈ 71 bits) and much easier to type correctly.
How many words should I use?+
Six words is the sweet spot for most accounts (≈ 77.5 bits). Use five for low-stakes logins and seven or more for high-value targets like your password manager master password or disk encryption. The tool shows live entropy and a crack-time estimate as you adjust.
Does capitalizing words or adding symbols make it stronger?+
Barely. The security lives in the random words. Capitalization is a deterministic transform (adds nothing), while an appended digit adds ≈ 3.3 bits and a symbol adds 3 bits. They are useful for satisfying “must contain a number/symbol” rules, not for real security gains.
Is my passphrase sent anywhere?+
No. The 7,776-word list is embedded in the page and every word is drawn with your browser’s cryptographic random generator. Nothing is uploaded, logged, or stored — and you should still avoid reusing any passphrase across sites.
More free tools
Want guides and tips? Visit the ToolsOfWeb blog or go back to the homepage.
Related guide