Secure Password Generator

What a passphrase is, and why it beats a clever password

A passphrase is several ordinary words picked at random and joined together — correct horse battery staple, rather than C0rr3ct!. The strength comes entirely from the picking being random. Six words drawn by dice from a list of 7,776 can be arranged 7,776 to the power of six ways, which is around 221 thousand million million different passphrases, all equally likely.

A password a person invents is not drawn from anything like that many possibilities, whatever it looks like. People reach for names, dates, keyboard patterns and the same three substitutions — a for @, o for 0, an exclamation mark on the end — and cracking software has known that for twenty years. It tries the predictable transformations of common words first, so the effort spent making a word look complicated buys very little.

The practical advantage of words over characters is that you can hold them. A sequence of six real words can be rehearsed a few times and recalled a week later; fourteen random characters generally cannot, which is why people write those down badly or reuse them.

How to use this page

Everything else — word length limits, the separator character, capitalisation, an acrostic, and the separate random-password mode — is under Advanced options, closed by default so that the common case stays two clicks.

1. Press Generate. The default is six words from the EFF long list, which is the EFF’s own recommendation for that list.
2. Read the entropy line under the result. It tells you how strong these settings are and states the assumptions behind the figure.
3. Press Copy. The passphrase goes to your clipboard exactly as shown, character for character, including the separators.
4. Paste it into the site or app, and into your password manager. Nothing is copied automatically, and nothing is copied until you press the button.
5. If you do not like the result, press Generate again. There is no history: the new passphrase replaces the old one and the old one is gone.

What happens to a passphrase generated here

ToolAcre generates passwords locally in your browser. For highly sensitive environments, verify your browser, device and operating system are trusted before using any web-based password generator.

You can check all of this yourself. Open your browser’s network panel, generate a dozen passphrases, and watch that nothing is requested.

• It is generated in your browser tab, by your browser’s own cryptographic random number generator. There is no server involved once this page has loaded.
• It is never sent to ToolAcre. There is no request that could carry it: this product’s Content-Security-Policy restricts the page to its own origin, which the browser itself enforces.
• It is never written to local storage, session storage, a cookie, a database in the browser, or the address bar. Reloading the page discards it; closing the tab discards it.
• It is never written to the browser console, and there is no analytics script and no advertising script on this page to read it.
• There is no account, no sign-in and nothing to create. The only files this page downloads are the word lists themselves, which are static text.
• No history is kept. Pressing Generate replaces the current value, and there is no way to get a previous one back — by design, because a list of previously generated passwords is a liability and not a feature.

Where to keep it

Whatever you generate here is best kept in a reputable password manager rather than in your head, a notes app or a spreadsheet. A manager means the passphrase for each account can be different, which is the single change that limits the damage when one site is breached.

A passphrase you will type often — the one unlocking the manager itself, or your device login — is the case where memorability earns its keep. For the hundred accounts behind the manager, length and randomness matter and memorability does not, so a long random password is usually the better choice there.

Where the words come from

All three word lists shipped with this page are the published Electronic Frontier Foundation word lists, used under CC BY. The long list holds 7,776 words; the two short lists hold 1,296 words each.

One change has been made to the files. The EFF publishes them with two columns — a five-digit dice roll and then the word — and the dice-roll column has been removed, because this page draws with the browser’s random number generator rather than with dice. The words themselves are unchanged, in the same order.

ToolAcre is not affiliated with, endorsed by, or sponsored by the Electronic Frontier Foundation. The lists are used and attributed under the terms of their licence, which is exactly what that licence provides for.

• The EFF’s word lists for random passphrases — the creators’ own page, explaining how each list was built and why.
• The Creative Commons Attribution licence — the licence the word lists are used under.

Read more

Five short pages cover the reasoning behind the defaults, the arithmetic, the honest limits, and where the word lists come from.

• Choosing a passphrase — why random beats clever, how many words to use, what the length range and separator actually change, and when a random password is the better tool.
• How entropy is calculated — the log2 formula, worked examples for all three lists, what the acrostic option costs you, and why a strength meter disagrees.
• Questions — whether words can repeat, whether anyone can see what you generate, what to do if Copy does nothing, and whether to write a passphrase down.
• Limitations — what this tool does not do, what entropy does not protect you from, and the situations where a browser-based generator is the wrong choice.
• Credits and licences — the xkcdpass project the generation logic is adapted from, and the EFF word lists this page ships.