Generate strong, memorable passphrases instantly — multiple results at once, so you can pick your favourite. Uses the EFF word list and cryptographically secure randomness. Nothing leaves your browser.
More free word and generator tools
Numbers, names, games and more
A passphrase is a sequence of random words used as a password — for example, correct-horse-battery-staple. Instead of trying to remember a string of symbols like X#m9!qL2, you remember a short story or mental image. The randomness comes from how the words are selected (by a cryptographic random number generator, not by you), not from the words being obscure. Common words chosen randomly are statistically far harder to crack than clever-looking passwords chosen by humans.
The concept was popularised by the XKCD comic "Password Strength" and is now the recommended approach by NIST (the US National Institute of Standards and Technology), the Electronic Frontier Foundation, and most professional security researchers.
| Passphrase | Traditional password | |
|---|---|---|
| Example | flame-orbit-cedar-mist | F@m3!x9#Rq |
| Entropy (typical) | 51–77 bits (4–6 words) | 30–50 bits (8–12 chars) |
| Easy to remember | Yes — words form a mental image | No — symbols are hard to recall |
| Easy to type | Yes — common words, no hunting for @ | No — special chars slow you down |
| Works on all sites | Yes | Yes |
| NIST recommended | Yes — length over complexity | No — complexity rules are now discouraged |
Traditional password advice — add numbers, symbols, capital letters, make it complex — backfires in practice. It produces passwords that are hard for humans to remember but not actually hard for computers to crack, because humans follow predictable patterns (P@ssw0rd, Summer2024!). Passphrases solve both problems at once:
This tool picks words at random from the EFF large word list — 7,776 common English words curated by the Electronic Frontier Foundation specifically for this purpose. Words were chosen to be easy to spell, easy to type, and unambiguous when spoken aloud (no words that sound identical to other words).
Randomness comes from the Web Cryptography API (crypto.getRandomValues), the same secure source used by password managers and cryptographic software. This is a fundamentally different level of randomness than Math.random(), which is suitable for games but not for security. Nothing is sent to any server — generation happens entirely in your browser, and your passphrases are never transmitted or logged.
You only need to memorise one passphrase: the master passphrase for your password manager. Use a 5 or 6-word passphrase for this — it is the key to everything else, so make it strong. Then generate unique passphrases for every other account and let the password manager store them. You never have to remember (or even see) your other passphrases again. Popular password managers include 1Password, Bitwarden (free and open source), and Dashlane.
For accounts where you must type the passphrase by hand — a device login, for example — pick a 4 or 5-word passphrase and practise typing it a few times. The regularity of real words makes them much faster to type than symbol-heavy passwords.
crypto.getRandomValues), which is cryptographically secure randomness, not the weaker Math.random(). The word list is the EFF large wordlist, the same standard used by Bitwarden, 1Password, and other professional password managers. Your passphrases never leave your device.P@ssw0rd123. Most sites accept passphrases as long as they meet any minimum length requirement. For critical accounts (banking, email, your password manager master password), use 5 or 6 words and enable the number option to satisfy sites that require a digit.