What is a passphrase?
A passphrase is a password made of several random words, such as Tiger-Lamp-Ocean7-Pilot-Maple. The idea is simple: length is the best defence against guessing, and real words are much easier to remember and type than something like x9#Qe!2v. That is why many security bodies recommend them for passwords you must keep in your head — your password manager’s master password or your computer login.
How to use the generator
- Choose the number of words (5 is good for most uses, 6+ for sensitive accounts).
- Pick a separator, and add a digit or a symbol if the site requires one.
- Click “Generate” until you like the result, then copy it.
- Save it in a password manager, or type it a few times until it sticks.
Why is it secure?
Each word is picked from a list of more than 400 short English words using the browser’s cryptographically secure random generator (crypto.getRandomValues), not Math.random. Each word adds about 8.7 bits of strength:
| Words | Approx. strength | Suggested use |
|---|---|---|
| 4 | ~35 bits | low-value accounts with two-step verification |
| 5 | ~44 bits (+ digit ≈ 50) | most accounts |
| 6 | ~52 bits | main email and banking |
| 7+ | 60+ bits | password-manager master password, disk encryption |
The calculation assumes the attacker knows the word list and the method: the strength comes from randomness, not from keeping the method secret.
Common mistakes
- Don’t pick the words yourself or use a famous quote or lyric — people choose predictable words.
- Don’t reuse the same passphrase on several sites.
- Test your result with the password strength checker.
Passphrases are generated in your browser and never sent to a server.