🔒 Generated in your browser with crypto.getRandomValues. Never sent to our servers.
Strong passwords you can actually remember
Random words joined together beat short complex passwords: they are longer, easier to type on a phone and far easier to remember. Pick the number of words, a separator and whether to add capitals or a number.
How strong is a passphrase?
Each word is picked at random from 2,182 common English words, so every word adds about 11 bits of entropy:
| Words | Entropy | Good for |
|---|---|---|
| 4 | about 44 bits | Low-value accounts with rate limits |
| 5 | about 55 bits | Most online accounts |
| 6 | about 67 bits | Email, banking, work accounts |
| 7–8 | 78–89 bits | Password manager master passwords, disk encryption |
When to use a passphrase
- Passwords you type by hand: laptop and phone logins, Wi-Fi networks, password manager master passwords.
- Shared secrets you read out or write down, such as a temporary account for a colleague.
- Many at once: generate a list for onboarding test accounts and export it as CSV or for Bitwarden.
The words are chosen with crypto.getRandomValues in your browser and never sent anywhere. For maximum entropy per character use the password generator; for numeric codes, the PIN generator. Need test data rather than secrets? Try the data generator.
FAQ
What is a passphrase?
A passphrase is a password made of several random words, like Orbit-Candle-Mellow-Fuse-Ridge. It is easier to remember and type than random characters while staying hard to guess.
How many words should a passphrase have?
Five words give about 55 bits of entropy with our list of 2,182 words, which is strong for most accounts. Use six or more for password manager master passwords and encryption keys.
Do capitals, separators or a number make it stronger?
A little. Most of the strength comes from the number of random words; every extra word adds about 11 bits. A separator and capitals make the phrase easier to read and satisfy rules that demand them.
Are the words really random?
Yes. Each word is picked with crypto.getRandomValues in your browser. The strength meter is calculated from the size of the word list, not from how the phrase looks.