Passphrase Generator (Diceware, EFF Lists)
Generate strong, memorable Diceware passphrases from the EFF long or short word lists with your browser's secure random generator. See entropy instantly.
- Loading the word list…
Assumes the attacker knows the word list and your settings and makes 100 billion guesses a second. Average time is half of all possibilities.
Options
Look up your own dice rolls
Word lists: EFF Long Wordlist and Short Wordlists 1 and 2 by the Electronic Frontier Foundation, used under CC BY 3.0 US.
How to use it
Five passphrases appear as soon as the page loads. Copy one you like, or press Generate new for another batch; changing a setting makes a fresh batch straight away.
- Word list and Words set the strength (see below). Six words from the long list is the usual recommendation.
- Separator and capitalisation only change how the words are written, to fit a site’s password rules. They add no strength, because an attacker is assumed to know your settings. In all three lists no word is the start of another, so even with no separator a passphrase splits back into its words only one way.
- Add a digit / a symbol puts one random digit or one of
! # $ % & * + = ? @at the end of a random word, for sites that insist; each adds about 3.3 bits. - How many makes 1 to 100 passphrases at once.
The three EFF word lists
| List | Words | Dice per word | Bits per word |
|---|---|---|---|
| Long list | 7,776, mostly 5 to 9 letters | 5 | 12.925 |
| Short list 1 | 1,296 of at most 5 letters | 4 | 10.340 |
| Short list 2 | 1,296 longer, distinctive words | 4 | 10.340 |
The Electronic Frontier Foundation made the lists for Diceware, where dice pick each word (6⁵ = 7,776 and 6⁴ = 1,296). The short lists are quicker to type, so use more words: five short words give exactly the strength of four long ones (6²⁰ possibilities each), and eight short words (82.7 bits) beat six long ones (77.5 bits). In short list 2 every word has a unique first three letters and differs from every other word by at least three letters, so a typo cannot turn one word into another.
Where the randomness comes from
The dice are replaced by crypto.getRandomValues, the browser’s
cryptographically secure random number generator. A random 32-bit number is
only used if it falls below the largest multiple of the list size that fits
in 32 bits; otherwise it is thrown away and a new one is drawn. This
rejection sampling avoids the small bias of a plain remainder, so every
word is exactly equally likely. Nothing is sent anywhere.
How strength is calculated
Strength is bits of entropy, assuming the attacker knows the list and every setting. Each word adds log2 of the list size. One random word in capitals adds log2 of the number of words, and a digit or a symbol adds log2(10) ≈ 3.32 bits each. Where the digit or symbol lands is not counted, which keeps the estimate on the safe side.
| Words | Long list | Short list | Long list, average crack time |
|---|---|---|---|
| 4 | 51.7 bits | 41.4 bits | about 5 hours |
| 5 | 64.6 bits | 51.7 bits | about 4.5 years |
| 6 | 77.5 bits | 62.0 bits | about 35 thousand years |
| 8 | 103.4 bits | 82.7 bits | about 2.1 trillion years |
The crack time is half of all possible passphrases divided by the guessing speed, here 100 billion a second: roughly one high-end graphics card against a fast hash such as MD5. Rate-limited logins and slow hashes such as bcrypt or Argon2 are millions of times slower to attack.
Tips
- Use a passphrase for the few secrets you must remember, such as your password manager and computer login, and let the manager create the rest.
- Do not swap or reorder words to form a sentence you like. Any human choice reduces the randomness.
- Prefer real dice? Roll five dice per word (four for the short lists) and type the results into the lookup box to get the matching words.
Word list credit
The EFF Long Wordlist and EFF Short Wordlists 1 and 2 are by the Electronic Frontier Foundation (eff.org), published under the Creative Commons Attribution 3.0 United States licence (CC BY 3.0 US). This page uses the words unchanged, without the dice numbers.
Frequently asked questions
Is it safe to generate a passphrase on a website?
This page makes passphrases entirely in your browser with the Web Crypto random generator. They are never sent to a server, logged or stored, and they are gone when you close the tab. You can disconnect from the internet after the page loads and it keeps working.
How many words should my passphrase have?
With the long list, six words (about 77.5 bits) is a good default for important accounts such as a password manager, and seven or more suits encryption keys that could face offline attacks. With a short list, use eight words for a similar strength.
Should I use the long list or a short list?
The long list gives the most strength per word. The short lists have shorter or more distinctive words that are quicker to type on a phone or TV remote, at 10.3 instead of 12.9 bits a word, so add words to make up the difference.
Is a passphrase better than a random password?
Bit for bit they are equally strong. A six-word passphrase and a 12-character random password of letters, digits and symbols both have about 77 to 79 bits of entropy, but the words are far easier to remember and type.
Why does adding a capital letter or a separator not increase the strength?
Strength counts only the random choices. If every word is capitalised, or the words are always joined with a hyphen, an attacker who knows the method tries that form first, so it adds nothing. Writing one randomly chosen word in capitals does add a little, and the entropy figure includes it.