Passphrase Generator
The Passphrase Generator builds Diceware passphrases: random words drawn from a 1296-word list using your browser's cryptographic random number generator.
100% in-browser · no data sent
Every draw is unbiased, so the entropy figure it reports is the real entropy of the process rather than a guess at how messy the result looks. 1296 is 6⁴, so each word maps to exactly four dice rolls and you can reproduce any passphrase with physical dice.
Embed This Tool
Add this tool to your website with customizable styling
How to Use
Choose how many words
Each word adds 10.3 bits of entropy. Six words is the usual floor, seven or eight is comfortable for anything that matters, and the strength badge tells you which band you are in as you drag the slider.
Set the format
Pick a separator and whether to capitalise. Some password fields demand a digit or a symbol; the checkboxes add one and the entropy figure accounts for exactly what they contribute — which is less than most people assume.
Generate a batch and pick one
The alternatives list gives you several to choose from. Choosing the one you find easiest to remember costs you no entropy, because they were all generated the same way.
Copy it into your password manager
Use a generated passphrase for the one or two passwords you must type from memory — your password manager's master password, your device login — and let the manager generate random strings for everything else.
Frequently Asked Questions
Is a passphrase really stronger than a complicated password?
Six random words from a 1296-word list is about 62 bits of entropy. P@ssw0rd!23, despite hitting every complexity rule, is worth far less, because it is built from patterns cracking tools try first: a dictionary word, predictable letter-to-symbol substitutions, and a trailing number. Length drawn from genuine randomness beats character variety drawn from human habit, every time.
Where does the randomness come from?
crypto.getRandomValues(), your browser's cryptographically secure random number generator, seeded by the operating system. It is not Math.random(), which is predictable enough to be useless here. The mapping from random bytes to a word is done with rejection sampling rather than a modulo, because random % 1296 would make the first words in the list very slightly more likely and quietly cost you a fraction of the entropy on display.
Why does capitalising every word not increase the entropy?
Because entropy measures the attacker's uncertainty about how the passphrase was made, not how it looks. "Capitalise every word" is a rule an attacker can simply apply too, so it doubles nothing. Random capitalisation genuinely adds one bit per word, because each word is then a coin flip — and the calculator credits only that. A tool that scores the finished string instead of the process will tell you otherwise, and it will be wrong.
Can I check the result with real dice?
Yes, and that is why the list has exactly 1296 words — 6⁴. Tick "show dice rolls" and each word appears with the four rolls that select it, so you can verify any word against the list by hand, or generate a passphrase with physical dice and look the words up. Physical dice are the one method that does not require trusting this page at all.