How to make a strong passphrase you can remember

The strongest passphrase you can remember is several words chosen at random by dice or a computer, not by you. Six words from a list of 7,776 give about 77 bits of entropy (the generator below prints them hyphenated). That's enough to protect an encrypted file even against a heavily funded attacker, and it's easy to type and remember after a week of use. The generator below makes them in your browser with the browser's secure random number generator, and nothing is sent anywhere.

Word listEFF large list (7,776 words)EFF short list 1 (1,296 words)cipher.ink's own list (288 words)

Words

SeparatorHyphenSpacePeriodCommaNone

CapitalsNoneEvery wordOne random word

Digits at the endNone1234

Make five more

These are generated in your browser with the browser's cryptographic random number generator. They are never sent to us or anyone else; we never see them.

Why random words beat a clever password

A password is as strong as the number of guesses an attacker needs, and people are bad at inventing unguessable things. We pick pet names, birth years, a favorite team and a symbol on the end, and attackers' dictionaries are built from exactly those habits. A passphrase of random words moves the strength out of your head and into arithmetic. If the words come from a list of N words and you pick k of them uniformly at random, an attacker who knows your method must try N^k combinations. That count is the whole security. Take the logarithm to base 2 and you have the strength in bits, and each extra bit doubles the work.

Each word from the 7,776-word list is worth log₂(7,776) = 12.92 bits, and each from the 1,296-word list 10.34 bits. The numbers are computed, not copied. The crack-time estimator uses the same arithmetic and also shows what those bits are worth against different kinds of storage (how long would it take to crack my password?).

Making one with dice

1. Get the EFF large word list (7,776 words, each numbered with five digits from 1 to 6). The generator above uses the same list.
2. Roll five six-sided dice and read them in order as a number such as 3-4-1-6-2. Find that number in the list, and that's your first word.
3. Repeat for each word, six times for a master password.
4. Use the words exactly as they come. Don't re-roll words you dislike, swap in your own or skip an odd one. Every choice you make by hand removes some randomness.

The method is called Diceware, and Arnold Reinhold published it in 1995. The Electronic Frontier Foundation released three improved lists in July 2016, the large list of 7,776 words for five dice and two short lists of 1,296 words for four dice, with fewer rare or confusing words. For most uses the EFF recommends a six-word passphrase from the large list. Dice aren't a quaint choice, because a table die doesn't depend on any software being honest. A computer generator is just as good if it uses a cryptographically secure random generator and picks without bias (a subtle bug we fixed in our own generator).

What cipher.ink's own generator does

When you press the dice button in the editor, the page picks . That's bits. It's quick to read out over the phone, and PBKDF2 makes each guess costly, but it falls well short of the six-word recommendation above. The security page spells out why that matters. A message that isn't set to burn can be downloaded by anyone who has the link, and its passphrase then has to stand up to an offline attack. For anything valuable, turn on burn after reading, type a longer passphrase of your own into the box and watch the meter, or generate six words here and paste them in.

Making it stick in your head

• Make a picture. Link the words into a short, silly scene ("a walrus in a raincoat repairing a trumpet"). Odd images stick. The story is only a memory aid, and you must not use it to pick the words.
• Write it down at first. A paper note kept at home is fine while you learn it, and for a passphrase that unlocks a computer it beats a weak one in your head. Burn or shred it once you know it.
• Type it every day for a week. Muscle memory does most of the work.
• Use it for one thing. A passphrase you reuse is only as strong as the weakest place that stores it.

What doesn't help

• Picking the words yourself. A phrase from a song, a book or a movie is in attackers' dictionaries, and so is the famous "correct horse battery staple" from a 2011 comic, the one example you shouldn't use. Your own sentence, with its natural grammar, is far weaker than the same number of random words.
• Substituting characters. Turning "a" into "@" and "o" into "0" is built into every cracking tool and adds almost nothing.
• Adding a capital and a number at the end. That's the first thing attackers try. It adds a few bits (the digits in cipher.ink's generator add a little, deliberately), nowhere near the dozens another word gives you.
• Changing it on a schedule. NIST's current guidance (SP 800-63B) advises against forced periodic changes and complexity rules. It favors length, checking against lists of breached passwords, and changing a secret when there's evidence it's compromised.

What a passphrase can't do

It can't save a secret typed into a phishing page, kept in a note on a compromised computer or stolen by malware that records the keyboard. It also doesn't need to protect every account. A password manager makes a different random password for each site, so only the manager's master passphrase has to be memorized. Use a passphrase for that, for the lock on a laptop disk, and for the secrets you must be able to type from memory.

Common questions