Credits and licences

Where the generation logic and the three EFF word lists come from, under which licences, and what this page is not affiliated with.

The generation logic

The passphrase generation logic used by this tool is adapted from xkcdpass 1.30.0, an open-source project distributed under the BSD 3-Clause License. The adaptation reimplements the behaviour for the browser; the shape of the options — the word count, the length filter, the case modes, the delimiter choices and the acrostic — follows that project.

ToolAcre is not affiliated with, endorsed by, or sponsored by the xkcdpass project or its authors, and it is not affiliated with, endorsed by, or sponsored by xkcd or Randall Munroe. The name appears here to credit the work the logic is adapted from, which is what the licence asks for.

The full record of what was ported, from which release and verified how, is kept in the repository at docs/third-party/xkcdpass.md. It is the authoritative version; this page is the summary.

Where the words come from

All three word lists shipped with this page are the published Electronic Frontier Foundation word lists, used under CC BY. The long list holds 7,776 words; the two short lists hold 1,296 words each.

One change has been made to the files. The EFF publishes them with two columns — a five-digit dice roll and then the word — and the dice-roll column has been removed, because this page draws with the browser’s random number generator rather than with dice. The words themselves are unchanged, in the same order.

ToolAcre is not affiliated with, endorsed by, or sponsored by the Electronic Frontier Foundation. The lists are used and attributed under the terms of their licence, which is exactly what that licence provides for.

Two licences, not one

It is worth being precise about this, because conflating the two would misdescribe someone else’s work. The software is under the BSD 3-Clause License and belongs to the xkcdpass authors. The word lists are under CC BY and belong to the Electronic Frontier Foundation. Neither licence covers the other’s material, and nothing in either package is owned by ToolAcre.

  • Copyright and licensing — the site-wide copyright page, including how third-party components are recorded and how to raise a concern.

Everything else on this page

The interface, the prose, the entropy calculations and the explanations across these five pages were written for ToolAcre. The randomness comes from your own browser’s Web Crypto implementation; no random number library is bundled.

What happens to what you generate

ToolAcre generates passwords locally in your browser. For highly sensitive environments, verify your browser, device and operating system are trusted before using any web-based password generator.

  • Every passphrase and password is generated in your browser tab, by your browser’s own cryptographic random number generator. No server is involved once the page has loaded.
  • Nothing generated here is sent to ToolAcre. This product’s Content-Security-Policy restricts the page to its own origin, so the browser itself blocks any attempt to send data elsewhere.
  • Nothing is written to local storage, session storage, a cookie, an in-browser database, the address bar or the browser console. Reloading discards it; closing the tab discards it.
  • There is no account, no sign-in, no analytics script and no advertising script. The only files downloaded are the static word lists.
  • No history is kept. Generating again replaces the value, and the previous one is not recoverable.

Questions

Is this the xkcdpass tool?

No. It is a separate browser implementation whose generation logic is adapted from xkcdpass 1.30.0, which is distributed under the BSD 3-Clause License. There is no affiliation with that project or its authors.

Have the word lists been changed?

In one way only. The EFF publishes each list as two columns — a five-digit dice roll, then the word — and the dice-roll column has been removed, because this page uses the browser’s random number generator rather than dice. The words themselves are unchanged and in the same order.

Does the EFF endorse this page?

No. The word lists are used under CC BY, which requires attribution and expressly does not imply any endorsement, sponsorship or affiliation. ToolAcre has no relationship with the Electronic Frontier Foundation.

Are the word lists BSD-licensed like the code?

No, and the distinction matters. The software is BSD 3-Clause; the word lists are CC BY and belong to the EFF. They travel together in the upstream project, but they are two separate grants from two separate holders.

Limitations

  • This page credits the sources; it is not the licence text itself. The full texts and the porting record are in the repository, at docs/third-party/xkcdpass.md and in the third-party notices.
  • Naming a project or organisation here is attribution, not a claim of any relationship with it.
  • The word lists are English only, because those are the lists the EFF publishes and the only ones shipped here.
  • The upstream record disagrees with itself about which version of CC BY applies, so this page links the licence rather than asserting a version. The obligation — credit, licence link, and a statement of changes — is the same either way, and is met on every page that mentions the lists.

Last reviewed 2026-09-21.