Generate a Diceware passphrase
Six random words from the EFF short list give about 62 bits of entropy and are far easier to remember than a comparable string of symbols. The words are chosen by simulated dice rolls from your browser’s cryptographic random source, the entropy is shown exactly, and nothing is transmitted or stored.
How to use the Passphrase Generator
- Choose how many words you want — six is the usual minimum.
- Pick a separator, and add a digit or symbol if a site insists on one.
- Generate, and read the entropy figure to see what you actually got.
- Copy one into your password manager, or memorise it if it is a master password.
Where Diceware comes from
Arnold Reinhold published Diceware in 1995: roll five physical dice, read the resulting five-digit number off a numbered list of 7,776 words, and repeat. Because 7,776 is 65, every word is equally likely, and each one contributes log2(7776) = 12.92 bits of entropy. In 2016 the Electronic Frontier Foundation published its own lists, including two short lists of 1,296 words — 64, so four dice instead of five — chosen to be common, easy to spell and at most five characters long. This tool uses EFF Short Wordlist #1, shipped in the page, and simulates the four dice with crypto.getRandomValues using rejection sampling so no index is even slightly more likely than another. (The list is published by the EFF under Creative Commons Attribution 3.0 US.)
The entropy maths
Entropy measures how many equally likely possibilities an attacker must work through, and it depends only on the size of the pool and the number of independent choices — never on how random the result looks.
| Words | Entropy | Possible passphrases |
|---|---|---|
| 4 | 41.4 bits | 2.8 × 1012 |
| 5 | 51.7 bits | 3.7 × 1015 |
| 6 | 62.0 bits | 4.7 × 1018 |
| 7 | 72.4 bits | 6.1 × 1021 |
| 8 | 82.7 bits | 7.9 × 1024 |
The attacker is assumed to know the word list and the method — Kerckhoffs’s principle. Keeping the list secret is not a security measure, and assuming your particular words are obscure is how people talk themselves into four-word passphrases for things that deserve eight.
What does and does not add strength
Capitalising the first letter of every word adds zero bits, because it is a rule an attacker applies to the whole list for free. The same goes for swapping e for 3: password crackers such as hashcat run rule sets that perform exactly those transformations before trying anything harder. Appending one random digit adds log2(10) = 3.32 bits, and one random symbol from a ten-character set adds another 3.32 — useful only for satisfying a site’s composition rules, not for meaningful strength. Adding one more word adds 10.34 bits, which is three times as much as both together.
The separator matters more than it looks. With no separator, book keeper and bookkeeper collapse into the same string, which loses a small amount of entropy and makes the phrase harder to read back. A hyphen or a space keeps the word boundaries unambiguous.
When to use a passphrase
Use one where you must type the secret from memory: your password manager’s master password, full-disk encryption, an SSH key passphrase, a device login. For ordinary website logins, a long random string stored in a manager is better — you never type it, so memorability buys nothing, and a unique value per site is what actually limits the damage of a breach.
NIST’s Digital Identity Guidelines (SP 800-63B) back this up: they require a minimum of 8 characters, tell services to accept at least 64 and to allow every printable ASCII character including spaces, and explicitly say services should not impose composition rules or force periodic expiry. What they do recommend is checking new passwords against lists of previously breached values.
Verifying it
The dice values that produced the first passphrase are shown with the result. Roll four real dice against the EFF list published at eff.org and you will land on the same words — the point being that nothing here is proprietary or unverifiable, and you can generate a master password entirely offline with physical dice if you prefer.
Frequently asked questions
Is six words still enough?
Six words is about 62 bits, which resists an offline attack on a properly salted, slow hash for a very long time but is not unlimited. Use seven or eight words for a password manager master password or disk encryption.
Are the passphrases sent anywhere?
No. The word list is part of the page and the selection happens in your browser. Nothing is logged, stored or transmitted, and closing the tab discards everything.
Why not just use random characters?
For anything a manager types for you, do. Passphrases exist for the handful of secrets you must recall and type by hand, where 62 bits you can remember beats 90 bits you write on a sticky note.
Does a word being common make it weaker?
No. Every word in the list is equally likely, and the attacker is assumed to have the list. Common words were chosen deliberately because they are easier to spell and remember.
Can I use physical dice instead?
Yes, and for a master password it is arguably better. Four dice per word, read as a four-digit number against the EFF short list, gives an identical result with no computer involved.
Privacy
This tool runs entirely inside your browser using WebAssembly and the Canvas/File APIs. Your files are never uploaded to ToolFlint or any third party; you can verify this in your browser's network tab or by switching to airplane mode after the page loads. Read how we process files.
Last updated 2026-09-23.