Passphrase Generator

A passphrase is a sequence of random words (e.g., 'frost-blade-coral-drone') rather than a string of random characters. Passphrases are easier to remember and type while maintaining strong entropy. A 4-word passphrase from a 200-word list has ~28 bits of entropy; from a 7,776-word EFF list, it's ~51 bits per word — similar to a 9-character random password.

For most accounts: 4 words (~28 bits). For high-security accounts (email, banking, SSH keys): 6+ words (~40+ bits). NIST SP 800-63B recommends at least 15 characters for memorized secrets. A 6-word passphrase is typically 30-40 characters and far exceeds this threshold while remaining memorable.

Yes. All word selection uses crypto.getRandomValues() — the Web Crypto API backed by your OS's CSPRNG (Cryptographically Secure Pseudo-Random Number Generator). This is the same randomness source used by TLS, password managers, and OS key generation. Nothing is sent to any server.

Diceware was invented by Arnold Reinhold in 1995. You roll physical dice to select words from a numbered list — each 5-die roll selects 1 of 7,776 words. The digital version (used here) replicates the same principle with crypto.getRandomValues() instead of dice. The key insight: randomness comes from the word selection process, not word complexity.

Adding a number appended to the passphrase adds log2(100) ≈ 6.6 bits of entropy. This can help satisfy password policy requirements (must contain a number) while keeping the passphrase readable. Capitalizing words helps with similar policies. However, the words themselves provide most of the security — the main value of additions is policy compliance, not a dramatic security improvement.

Random passwords are better when: (1) you have a password manager and will never type it manually, (2) the system has a character limit too short for a passphrase, or (3) you need maximum entropy per character (base64 URL gives ~6 bits/char vs ~7.5 bits/word). For passwords you actually need to remember — master password, disk encryption, SSH key passphrase — passphrases are superior.