Tools · Passwords, passphrases and randomness
Passphrase generator
Random words from the EFF lists or ours, with the entropy worked out exactly and no bias in the draw.
These are generated in your browser with the browser's cryptographic random number generator. They are never sent to us or anyone else; we never see them.
This passphrase generator strings together random words from the EFF's word lists or cipher.ink's own, and tells you how many bits of entropy the result has. It works in your browser, with nothing sent anywhere, and it draws every word with the same chance. Six words from the large list gives 77.5 bits, which is plenty for a master password and easy to remember.
How to use a passphrase from this page
Pick one of the five, copy it, and put it where you need a secret you can remember. That might be a password manager's master password, a disk-encryption passphrase, or the passphrase on a cipher.ink message. Don't shop through the list by regenerating until one feels right, because choosing among results makes the choice less random. Take the first acceptable one, or press the button once and take any of the five. Then type it a few times to learn it, and write it down somewhere safe for the first week if you need to.
Six words from the large list is 77.5 bits, which is the figure the EFF recommends. That's long, but six ordinary words are easier to hold in your head than twelve characters of noise, which are worth 72 to 79 bits only if every one of them is truly random. The sense of "strong" you get from a pile of symbols is a feeling, not a measurement. The number printed under the generator is the measurement.
Where the entropy number comes from
Entropy here counts how many equally likely passphrases the generator could have produced. If a list has N words and you pick k of them uniformly and independently, there are Nk possible results, and the entropy is k × log2(N) bits. Each bit doubles the work for someone who has to guess. The calculation doesn't depend on the words being obscure. An attacker is assumed to know the list, the number of words and the separator, which is the right assumption, because only the choice of words is secret.
| Words | EFF large (7,776) | EFF short 1 (1,296) | cipher.ink (288) |
|---|---|---|---|
| 3 | 38.8 bits | 31.0 bits | 24.5 bits |
| 4 | 51.7 bits | 41.4 bits | 32.7 bits |
| 5 | 64.6 bits | 51.7 bits | 40.8 bits |
| 6 | 77.5 bits | 62.0 bits | 49.0 bits |
| 7 | 90.5 bits | 72.4 bits | 57.2 bits |
| 8 | 103.4 bits | 82.7 bits | 65.4 bits |
The page computed those figures from the actual list sizes when it was built. For comparison, a random 12-character password drawn from all 94 printable ASCII characters is 12 × log2(94) ≈ 78.7 bits, about the same as six EFF words and far harder to type from memory. Most people's invented "strong" passwords, with a capital first letter and a number at the end, have a small fraction of that, because humans are predictable.
The three lists
- EFF large list. It has 7,776 words (65, the number of outcomes of rolling five dice) at 12.9 bits per word. The Electronic Frontier Foundation published it in 2016 as an improvement on the original Diceware list of 1995. The words are familiar, 3 to 9 letters long, with no profanity, homophones or difficult spellings, and no word is the start of another.
- EFF short list 1. It has 1,296 words (64, four dice) at 10.3 bits per word. It's more memorable but needs more words for the same strength, and it holds the words EFF judged most memorable and distinct.
- cipher.ink's own list. It holds 288 short, common words, used by the compose page's dice button, which makes 5 words from a list of 288, plus a number from 10 to 99, about 47.3 bits. That's enough for a message whose passphrase is slowed by 600,000 rounds of PBKDF2 and shared separately from the link. If the message matters a lot, add words or use the large list here.
The EFF lists are © Electronic Frontier Foundation, released under a Creative Commons Attribution license, and the credit is on Credits. The page script combines them with cipher.ink's list in a file you can read.
Why the choice is made the careful way
The generator doesn't use Math.random(), which isn't designed to be unpredictable, and it doesn't take a random number modulo the list size, which makes some words more likely than others. It draws 32-bit random values from crypto.getRandomValues and throws away any that fall in the uneven top slice, a method called rejection sampling, so every word is exactly as likely as every other. cipher.ink's own passphrase generator once had the modulo bias and could never choose 32 of its 288 words. We found it, fixed it and wrote up what it cost. The modulo bias article has the before-and-after code, and the random source itself is covered in random numbers in the browser.
Common questions
Is a passphrase of random words really safer than a short complex password?
Per character typed, no, but per thing remembered, often yes. What matters is entropy, and words let a human hold a lot of it. Four random words from the large list (51.7 bits) beat most eight-character "complex" passwords, which are rarely random.
Should I add a number or a capital?
Only if a site demands it. A fixed pattern such as "capitalize the first word and add 1 at the end" adds almost nothing, because attackers try those patterns first. Capitalizing a randomly chosen word adds log2(words) bits, and each random digit adds 3.3. The tool counts them exactly.
How long does it take to guess one?
That depends on the hash it's stored under as much as on the passphrase. The line below the generator gives a simple estimate, and the crack-time estimator shows a table for different storage methods, with sources.
Can I trust a generator on a website?
You're trusting the page's JavaScript, which is true of any web tool. This one makes no network requests (our tests check that), and its code is plain and unminified, so you can read it. For the highest stakes, roll physical dice against the EFF list instead, which needs no computer.