Passphrase Generator

A passphrase is several random words strung together, and it can be both easier to remember and stronger than a short password full of symbols. This generator picks words from a list of about 1,280 short, common words using a secure random source, and shows an estimate of strength in bits based on the real list size and number of words.

How to use it

1. Choose how many words. Five or more is a good start.
2. Pick a separator, and optionally capital letters or a number.
3. Press Generate passphrases.
4. Copy one into a password manager.

When it helps

• Creating a master password you can remember.
• Making a Wi-Fi password that's easy to read out.
• Replacing weak, reused passwords.
• Generating passwords for accounts you don't want in a manager.

Good to know

• Each extra word adds about ten bits of strength.
• Don't reuse a passphrase across accounts.
• Add two-step sign-in wherever it's offered; it matters as much as the password.

Why words make strong passwords

A password's strength comes from how many possibilities an attacker has to try. Five words picked at random from a list of about 1,280 give 1,280 to the fifth power, around 3.4 times ten to the fifteenth, or roughly 51 bits. That's more than a typical eight-character password with symbols, and far easier to remember.

The key is true randomness. A phrase you make up yourself, like a lyric or a quote, is much weaker because attackers try common phrases first.

Worked example: a master password

For a password manager, choose six words, hyphens as separators and no number. A result such as lemon-orbit-tidy-canyon-swift-pillar has about 62 bits of strength. Memorise it by building a short story from the words: a lemon orbiting a tidy canyon.

Type it a few times over several days. Once you can type it without thinking, you're done, and the manager looks after everything else.

Limits and good practice

Passphrases are best for the few passwords you must remember: your manager's master password, your device login and your email. For everything else, use a manager to create long random passwords.

Never reuse a passphrase across sites, and turn on two-step sign-in. If a site limits password length or requires symbols, add a number or a symbol at the end, which helps a little.

Passphrase myths

Adding a capital and a symbol to a passphrase doesn't add much strength, since attackers know people do it. Adding another word adds ten bits, which is worth far more. Spaces and separators are fine, but they're not where the strength comes from.

Also, a passphrase isn't safer if you pick the words yourself. Humans choose predictable words, so let the generator do it.

Questions