Text & everyday tools · Password Generator
Why 'correct horse battery staple' works only if the words are random
· Why it matters
passwords passphrases randomness
The famous comic made passphrases popular and also spawned a bad habit — choosing your own words; this post explains why the strength depends entirely on random selection from a known list.
The comic everyone remembers and the lesson half of them missed — four common words are strong only when dice picked them
A memorable four-word sequence demonstrates a format, not the process that selected it. ToolAcre’s calculation depends on each position receiving an independent uniform index from the eligible word pool. If a person chooses four familiar words because they sound amusing or form a scene, the visible number of words stays four while the underlying distribution changes.
The repository does not use a comic or famous phrase as a source for a security threshold. It implements and tests a random selection routine. The practical lesson is to preserve that routine rather than copy a public example or imitate its grammar. Any phrase printed in an article is already known and must not become a credential.
Four familiar words are not evidence of a random selection process
Human choice can favour favourite objects, names, quotations, grammatical order and words that belong together. ToolAcre does not attempt to estimate those preferences, so it does not score an existing phrase. Calling a self-chosen sequence equivalent to four uniform draws would apply the generator formula to a process that never occurred.
Random selection can still produce two words that happen to relate or even repeat because draws use replacement. Editing that output until it feels more random introduces human preference after the fact. The honest procedure is to accept the fresh result or generate a wholly new candidate, without publishing either one.
Kerckhoffs's principle applied to wordlists — the attacker may know the entire EFF list and the passphrase stays strong
The EFF lists are public static assets, and that does not undermine the count of possible indices. For the long list, the build verifies 7,776 entries. An attacker may know every word, the order of the file and all settings; the unknown part is which independent indices Web Crypto selected for this particular private output.
This design avoids “security through a secret wordlist.” It also means filtering must be accounted for. If the user narrows allowed word lengths, the eligible pool becomes smaller and the entropy function uses that real pool rather than continuing to quote 7,776.
A public wordlist remains usable because the random index, not list secrecy, is the input
A phrase such as “red apple pie slice” carries associations and grammatical structure. The repository contains no model for how often people create that pattern, so it assigns no numerical search space. Treating the four tokens as independent merely because they are separated by spaces would ignore the selection evidence.
ToolAcre instead chooses each word through `secureRandomChoice` from the same eligible list. The previous word does not narrow the next draw. That independence is a property of the code path, not a visual property of the completed phrase.
Related words reveal a human process that this generator does not model
For four generated long-list words without filtering, the ordered output count is 7,776⁴ because each of four positions can receive any list index. The calculation is derivable inline from the verified file size. A person-created four-word phrase receives no matching number here because its candidate process is unspecified.
This comparison deliberately avoids crack-time estimates and does not print a generated phrase. It establishes only that one process is countable from known uniform choices while the other is not. Suitability for an account still depends on the destination, device and wider threat model.
Worked example: contrast a known uniform generator with an unquantified human phrase
A mnemonic story may be built after selection if it leaves the words, order, case rule and delimiters unchanged. The story is a memory aid, not a reason to substitute a nicer word. Publishing the story or phrase would reveal the credential, so keep both within the approved handling process.
ToolAcre itself does not teach or test mnemonic methods. It provides English words and formatting controls. Whether a particular result can be remembered is personal, and storage belongs to a manager rather than this page.
What this does not cover — the specific entropy claims in the comic and how they were calculated
This article does not reproduce specific entropy claims from the comic because the comic is not a repository source supplied for verification. It also does not claim that any number of words defeats every attack. Phishing, malware, reuse and a compromised destination remain outside list arithmetic.
The omission preserves a useful boundary: generated-choice mathematics can be checked directly against code and files, while cultural history and third-party claims need their own primary sources. The two should not be blended because the format looks familiar.
The takeaway — keep the idea, drop the habit; let the Password Generator pick the words from the EFF list
Keep the idea of a multiword credential, but let an audited random process choose the words. ToolAcre uses verified EFF assets, Web Crypto and unbiased indices. A public vocabulary is expected; a private fresh combination is the part that must remain unknown.
Do not choose words by theme, repair awkward outputs or reuse the result. Generation supplies one candidate and forgets it; management, storage and destination policy happen elsewhere. The strength calculation follows the random process, not the charm of the final sentence.