About the Passphrase Generator
Guidance from NIST and the UK's National Cyber Security Centre has moved away from forced symbols and quarterly resets towards longer passwords people can actually remember. A four or five word passphrase is easy to type on a phone, easy to recall, and far harder to crack than an eight-character string full of substitutions.
How to use the Passphrase Generator
- Choose how many words the passphrase should contain — four is a sensible minimum.
- Pick a separator and decide on capitalisation.
- Optionally append a number or symbol for sites that demand them.
- Copy the option you like, or regenerate for a fresh set.
Why use this tool?
Entropy shown in bits
Each configuration reports its strength, so you can see exactly what adding a word buys you.
Cryptographic randomness
Words are chosen with crypto.getRandomValues from a curated list of short, unambiguous words.
Five options at a time
Pick the one that reads well to you rather than accepting the first suggestion.
Frequently asked questions
How many words do I need?
Four words from a list this size gives roughly 50 bits of entropy — fine for most accounts. Use five or six for a password manager master password or anything protecting money or email.
Are passphrases really stronger than complex passwords?
Length beats complexity. 'Correct-Horse-Battery-Staple' has far more entropy than 'P@ssw0rd!' and is much easier to remember and type.
Is it safe to generate a password on a website?
Here, yes: generation happens entirely in your browser with no network request, and nothing is logged. Still, always change a password you have shown on screen to anyone.