Are word-based passwords safe and how do I make one?
Passphrase generator: instead of random characters like "Kx9$gF#pR2vZ" you get "able-tank-wide-yarn-zone-2", easier to remember, equally strong cryptographically.
The Diceware/EFF algorithm: 5-7 words from a ~500-word list = 50-70 bits of entropy, practically unbreakable by brute force.
Perfect for password manager master keys, laptop login, dictating over the phone. The whole generation happens in your browser.
How to use it
- Set the word count. 5-6 words is the standard (50-60 bits). 7+ for maximum security.
- Pick a separator: dash (-), underscore (_), period (.) or space. If a service rejects spaces, use a dash.
- Optional: uppercase (first letter of each word, or all), some sites require it.
- Append a digit and/or special character at the end. Most corporate policies require it.
- Click copy, paste straight into a password manager (1Password, Bitwarden, KeePassXC).
When this is useful
Five typical situations where a passphrase beats a random character string:
- Password manager master password. You only memorize one, so a passphrase is perfect (long but readable).
- Laptop or desktop login. You type it daily, much easier as a passphrase than random characters.
- Encrypted disk password (LUKS, BitLocker, FileVault). Typed at every boot.
- System admin password (root, sudo). Rarely used, but you have to remember.
- PGP / GPG key passphrase. Valuable keys, password committed to memory.
For regular accounts in your password manager, use the random password generator, you don't memorize it, so readability doesn't matter.
Questions and answers
Yes. 5 words from a 500-word list = 5 × log2(500) ≈ 45 bits of entropy. Cracking time on a GPU cluster (10^11 attempts/s) ≈ 50 years. 6 words = 54 bits ≈ 10,000 years. Practically unbreakable.