Passphrase generator (EFF wordlist)

What is a passphrase?

A passphrase is a password built from several words. The security comes from choosing each word independently at random from a sufficiently large list, not from writing a meaningful sentence or quotation. This generator uses the EFF long wordlist of 7,776 distinct entries. A selection from that list contributes about 12.9 bits of theoretical entropy per random word, so adding a word multiplies the possible combinations dramatically.

Three words can demonstrate the format but may be too short for an important account. Four words provide a larger space, while five or six are prudent when the phrase protects a password-manager vault or another high-value secret and the system accepts the length. Use the word count that matches the account’s consequences and recovery model. Never reuse the same phrase across services.

Passphrase vs password

A random character password is compact and works well with a password manager. A random-word passphrase is longer but can be easier to read, type, or memorize when manual entry is unavoidable. Neither format is automatically superior. A four-word phrase chosen from a large list can have more possible combinations than a short human-styled complex password, while a long generated character string may be stronger per character.

The critical word is random. Song lyrics, quotations, pet names, addresses, and grammatical sentences have structure that attackers can model. Adding a predictable capital letter and digit does not transform a familiar sentence into a uniformly random phrase. This page first chooses the words cryptographically, then offers optional capitalization and a digit as extra random choices. The entropy display describes that generator, not ordinary human language.

How Diceware-style generation works

Classic Diceware maps repeated physical dice rolls to a numbered wordlist. The EFF list contains every five-die result from 11111 through 66666. This browser version uses crypto.getRandomValues with rejection sampling to choose an unbiased index from the same 7,776 entries. The full list is bundled with login.com and loads only after the first generate action. No request is made to EFF or another service while you use it.

Separators affect compatibility more than the word-selection entropy. Spaces are readable but some sites reject them. Hyphens, periods, and underscores are widely accepted but not universal. Optional capitalization randomly selects one word; the digit is generated separately. If a service applies an unexpectedly short maximum, use the character password generator instead of manually trimming words from a generated phrase.

Use and store a random passphrase safely

Save the result in a password manager even if you plan to memorize it. Memory can fail during travel, stress, or an account incident. Avoid screenshots, unencrypted notes, and messages to yourself. If the passphrase protects the password manager itself, prepare the provider’s emergency kit or recovery model separately and keep it in a protected location that does not depend on unlocking the same vault.

NIST guidance emphasizes password length and discourages arbitrary composition rules that push people toward predictable patterns. That does not mean every long sentence is strong or that a passphrase stops phishing. Enter it only on the verified domain, add phishing-resistant authentication when available, and test account recovery before deleting an older method. Regenerate immediately if the output was exposed during setup.

Practical sequence

How to use this tool safely

1. 01

   Choose at least four random words for an ordinary important account and more for higher-value use.

2. 02

   Select a separator the destination accepts, then add optional random capitalization or a digit if required.

3. 03

   Generate and copy the phrase directly into a trusted password manager or verified service.

4. 04

   Test the new credential and keep a separate, protected recovery route.

References

Primary guidance

• EFF Dice-Generated Passphrases
• NIST SP 800-63B authentication guidance