Free tool
Passphrase generator
Make a strong password from random words: easy to remember, hard to guess. Created on your device, with the strength shown in plain numbers.
- Runs on your device
- Never saved or sent
- EFF word list
Your passphrase
Between words
Capitals and separators help with sites that demand them, but add no real strength. More words is what counts.
Strength
Very strong- Weak
- Fair
- Strong
- Very strong
Average time to guess
35 thousand years
At 100 billion guesses a second, by someone who knows exactly how it was made.
- Entropy
- 78 bits
- Words
- 6 from 7,772
Words from the EFF Large Wordlist by the Electronic Frontier Foundation, used under CC BY 3.0 US.
How it works
How to make a strong passphrase
A passphrase is only as strong as it is random. This generator picks every word by chance from a list of 7,772, so you get the full strength, not a phrase that just sounds random.
- 1
Pick how many words
Six words is a strong default. Use more for anything that protects a lot, like a password manager.
- 2
Choose the details
Pick what goes between the words, and add capitals or a number if a site insists on them.
- 3
Copy it somewhere safe
Press New passphrase until you get one you like, then copy it into your password manager or the site you're signing up to.
How many words do you need?
Average time to guess at 100 billion guesses a second, by someone who knows the word list and how many words you used.
| Words | Entropy | Average time to guess |
|---|---|---|
| 4 words | 52 bits | 5 hours |
| 5 words | 65 bits | 4 years |
| 6 wordsRecommended | 78 bits | 35 thousand years |
| 7 words | 90 bits | 271 million years |
| 8 words | 103 bits | 2 trillion years |
How to use a passphrase well
A strong passphrase only helps if it stays private and you use it in one place.
- Use a different passphrase for every account. A password manager can remember them for you.
- Don't swap in your own words or pick the ones you like best. The strength comes from the words being chosen at random.
- Use more words for your password manager or main email, since they unlock everything else.
- Write it down only somewhere safe and private, never in a note on your phone or a sticky note on the screen.
Why this generator
A passphrase no one else has seen
Made on your device
Your browser's secure random number generator picks the words. The page can't connect to the internet, so no one else ever sees it.
Easy to type, hard to guess
Real words are easier to remember and type on a phone than random symbols, and six of them is far harder to guess than a typical password.
Honest numbers
The strength shown assumes the attacker knows exactly how it was made. No made-up scores, just the maths.
Use a pattern lock?
Draw it and see how easy it would be to guess, with the reasons and how to make it stronger.
Pattern lock strength checkerPrivate photos need more than a password
VaultShield keeps photos and videos encrypted on your iPhone, behind a pattern lock, with its own 24-word recovery phrase if you forget it.
How the recovery phrase worksFAQ
Questions about passphrases
More free tools: pattern lock strength checker, photo metadata viewer, or see all tools.
A password made of several random words, like correct-horse-battery-staple. Because each word is picked at random from a long list, a few words are very hard to guess, yet much easier to remember and type than a jumble of symbols.
Six words is a strong choice for most accounts: about 78 bits of entropy, which would take an average of 35 thousand years to guess at 100 billion guesses a second. Use seven or more for a password manager or anything that unlocks other accounts. Four words is the bare minimum.
With this tool, yes: it isn't really online. The passphrase is made by your browser, on your device, using its built-in secure random number generator. It's never saved or sent anywhere, and the page blocks itself from connecting to the internet, so it works in airplane mode after it loads.
The EFF Large Wordlist from the Electronic Frontier Foundation: common, easy-to-spell English words designed for passphrases. We left out its 4 hyphenated words, like t-shirt, so a hyphen between words is never confusing, which leaves 7,772. Each word adds about 12.9 bits of strength.
Barely. Capitalising every word or using a dot instead of a hyphen is a fixed choice, so it adds nothing an attacker has to guess. Adding a number to a six-word passphrase adds about 6 bits, under half a word. They're there for sites that require them. Adding a word does more.
A way to pick passphrase words by rolling five dice for each word and looking the number up in a list. This tool uses the same EFF list, but your browser's secure random number generator does the rolling.
No. Wallet seed phrases use a different word list and a built-in checksum, and should only ever be created by the wallet itself. The same goes for VaultShield's recovery phrase: the app makes its own 24 words for you.
Usually, yes. A random six-word passphrase is stronger than most passwords people make up, and easier to remember and type. For accounts you never type yourself, a password manager's random password is just as good.