Passphrase Generator
Generate random passphrases online — multiple unrelated words that are easy to remember but hard to crack. More memorable than random passwords with equivalent or better security for most authentication scenarios.
Why Use a Passphrase Instead of a Password
A passphrase like correct-horse-battery-staple is easier to remember than Xk9#mP2$vL and can actually be more secure. Four random common words produce a search space of billions of combinations — far more than an 8-character random password. Passphrases are ideal for master passwords (password managers, disk encryption, SSH keys) where you need both strong security and the ability to type it without looking at a screen. They also survive the "write it on a sticky note" problem — a memorable passphrase doesn't need to be written down.
- High entropy: 4 random words from a 7,776-word list gives ~51 bits of entropy — stronger than most passwords
- Memorable: Random word combinations form mental images that stick
- Typeable: No special characters required — works on any keyboard, device, or login screen
- Cryptographically random: Generated using your browser's
crypto.getRandomValues()— not predictable - No account needed: Generate as many passphrases as you need, instantly
Choose the Right Variant
- This page: Passphrases — memorable word combinations for master passwords and encryption keys
- Password Generator: Random character passwords with symbols and numbers
- Secure Password Generator: High-entropy passwords for accounts and APIs
- Random Password Generator: Configurable random passwords
Step-by-Step Tutorial
- Open the password generator and select passphrase mode if available, or generate a memorable output
- A set of random words is generated using cryptographically secure randomness
- If the combination isn't memorable enough, regenerate — takes less than a second
- Add a number or symbol between words if the service requires it:
correct-horse-7-battery - Test that you can recall the passphrase after 5 minutes before committing to it
- Never reuse the same passphrase across multiple accounts
When to Use Passphrases vs Passwords
- Use passphrases for: Password manager master password, full-disk encryption (BitLocker, FileVault), SSH key passphrase, GPG key passphrase, Wi-Fi network passwords
- Use random passwords for: Individual website accounts (stored in a password manager), API keys, database credentials, service tokens — where you never type them manually
- The key distinction: If you need to memorise it and type it manually, passphrases win. If it lives in a password manager or vault, use a random password for maximum entropy per character.
Privacy and Data Handling
Passphrase generation runs entirely in your browser using the Web Crypto API's crypto.getRandomValues(). Generated passphrases are never sent to any server and are not logged. Close the tab and the passphrase is gone — store it securely immediately after generating.
Frequently Asked Questions
How many words should a passphrase have for strong security?
Four words from the EFF Large Wordlist (7,776 words) gives approximately 51 bits of entropy — considered strong for most purposes. Five words gives ~64 bits, equivalent to a random 10-character password with full character set. Six words (~77 bits) is considered strong enough for high-value targets. Most password managers and encryption tools are adequately protected by 4–5 words. If a site requires a minimum number of characters, 4–5 words separated by hyphens typically satisfies even 20-character minimums while remaining memorable.
Are passphrases really harder to crack than passwords?
Yes, when both are truly random. A 4-word passphrase drawn from a 7,776-word list has 7,776⁴ ≈ 3.6 trillion possible combinations. A random 8-character password using lowercase only has 26⁸ ≈ 208 billion combinations — fewer. The issue is that people don't choose truly random passwords — they use patterns, names, and dictionary words. The advantage of passphrases is that they're random but memorable, so users are more likely to use them properly. A random 12-character password with symbols (~72 bits) still has higher entropy than a 4-word passphrase, but it won't be memorised without a tool.
Can I use a passphrase for my email or social media accounts?
Yes, but only if you don't reuse it. The main risk with memorable passphrases is reuse — if one site is breached, attackers try the same passphrase on other sites. Use a unique passphrase (or random password stored in a password manager) for every account. Enable two-factor authentication on your email account regardless of password strength — email account access enables password resets on most other services, making it the highest-value target. A passphrase for email with 2FA is an excellent security combination.