How to choose a passphrase

The only thing that makes a passphrase strong is that you did not choose it

This is the whole idea, and it is worth stating bluntly because almost every piece of password advice obscures it. A passphrase is strong in proportion to the number of equally likely passphrases the process could have produced. If a machine picks six words uniformly from a list of 7,776, that number is 7,776 to the sixth power. If a person picks six words that feel random, the number is very much smaller, because people are not uniform samplers and never have been.

Ask someone for a random animal and you will hear dog, cat or lion far more often than aardvark. Ask for a random four-digit number and 1234 and years beginning 19 are wildly overrepresented. Cracking software is built on exactly these regularities: it does not guess in alphabetical order, it guesses in order of likelihood, and human choices sit at the front of that queue.

So the value of this page is not the words. It is that neither you nor anyone else influenced which ones came up.

Why six words is the default

Six words from the EFF long list is the Electronic Frontier Foundation’s own recommendation for that list, and this tool defaults to it. Each word contributes about 12.9 bits, so six of them come to roughly 77 bits — enough that an offline attacker running a trillion guesses a second would still be searching for an extremely long time, while the phrase itself remains short enough to rehearse.

Five words, about 64 bits, is the point where a well-resourced offline attack stops being theoretical. It is a reasonable choice for an account you do not much care about, and a poor one for anything that protects other things.

Seven or eight words is worth it for the two or three passphrases that guard everything else: the one that unlocks your password manager, your device login, your email account. Those are the passphrases you will type often enough to learn, and the ones whose compromise costs the most.

Going beyond eight words has sharply diminishing value. At that point the passphrase is already far out of reach of any guessing attack, and the realistic threats — a phishing page, malware on the machine, a badly run website storing it in plain text — do not care how long it is.

Which word list to use

The long list holds 7,776 words — six dice rolls of five dice — and is the default because each word carries the most strength: about 12.9 bits. Its words are longer and a few are obscure, which is the trade you make.

The short list holds 1,296 words at about 10.3 bits each. The words are more common and quicker to type, which matters if you will be entering the passphrase on a games console or a television remote. Because each word is worth less, you need roughly seven or eight of them to match six from the long list.

The third list is the same size as the short list but chosen so that no word is a prefix of any other, and so that the first three letters identify the word uniquely. That is a real convenience on a device with autocomplete or with an awkward keyboard, and it costs nothing in strength relative to the ordinary short list.

A larger list is not automatically better. What matters is the number of words multiplied by the strength of each, and a short list with an extra word or two gets to the same place.

What the advanced options actually change

The minimum and maximum word length filter the list before any word is drawn. This is a genuine trade: narrowing the range to five to nine letters makes the result easier to read and type, but it also shrinks the pool every word comes from, so each word carries slightly less strength. The entropy figure on the page is calculated from the filtered pool, not the full list, so it already reflects whatever you choose.

The separator changes how the words are joined. A space reads best and is what most people find easiest to retype, but some login forms trim or reject spaces, which is why hyphens and underscores are offered. Choosing the random option picks a fresh separator for each gap from five characters, which adds a small amount of real strength — about 2.3 bits per gap — and is counted in the figure shown.

The case options exist because many sites still demand a capital letter. Lower case, upper case, capitalising the first letter and alternating are all fixed rules: an attacker who knows the rule gains nothing from it, so none of them adds strength. The random option is different — each word is independently upper or lower case, which adds exactly one bit per word and is counted.

An acrostic constrains each word to start with a letter you choose, so the initials spell something. It is a memory aid and it costs strength: instead of drawing from the whole pool, each word is drawn from the much smaller set beginning with that letter. The page recalculates the entropy for the letters you type, and it will tell you plainly if no word in the current list and length range starts with one of them.

Passphrase or random password?

Use a passphrase where a human has to remember and type it: the password manager’s own master password, a device login, a disk encryption key, an account you need to reach from a machine that has no password manager on it.

Use a random password everywhere else — which, if you use a manager properly, is almost everywhere. You never type those, so memorability buys nothing, and twenty random characters pack more strength into fewer keystrokes than the equivalent passphrase.

A random password of twenty characters drawn from a mixed alphabet of around eighty symbols is worth roughly 126 bits, which is comfortably more than eight words from the long list. This page generates those too, in the random-password section under Advanced options.

Both are in the same place for a reason: the right answer depends on whether a person or a program will be doing the typing, and that is a question worth asking each time rather than settling once.

Using the result well

One more habit worth forming: change a passphrase when there is a reason to — a breach notice, a shared device, a suspicion — rather than on a calendar. Forced periodic rotation reliably produces weaker passwords, because people cope with it by incrementing a number on the end.

1. Copy it with the Copy button rather than by selecting the text, so nothing is lost or trimmed at either end.
2. Paste it straight into your password manager before you paste it anywhere else. A passphrase that never reaches the manager is one you will end up resetting.
3. Use it for one account and nothing else. Reuse is what turns one site’s breach into a problem for all your accounts, and no amount of entropy helps with it.
4. Do not add a memorable tweak — your birth year, the site’s name, an exclamation mark — to make it feel more personal. Those additions are exactly what guessing software expands first, and they undo the randomness you came here for.
5. If a site rejects the passphrase for being too long or containing spaces, shorten it by a word or switch the separator rather than inventing a substitute by hand.

What happens to what you generate

ToolAcre generates passwords locally in your browser. For highly sensitive environments, verify your browser, device and operating system are trusted before using any web-based password generator.

• Every passphrase and password is generated in your browser tab, by your browser’s own cryptographic random number generator. No server is involved once the page has loaded.
• Nothing generated here is sent to ToolAcre. This product’s Content-Security-Policy restricts the page to its own origin, so the browser itself blocks any attempt to send data elsewhere.
• Nothing is written to local storage, session storage, a cookie, an in-browser database, the address bar or the browser console. Reloading discards it; closing the tab discards it.
• There is no account, no sign-in, no analytics script and no advertising script. The only files downloaded are the static word lists.
• No history is kept. Generating again replaces the value, and the previous one is not recoverable.

Questions

Limitations

• Word lists are English. A passphrase made of English words is no weaker for a non-English speaker, but it will be harder to remember, which is most of the point.
• The entropy figure describes the settings, not the particular passphrase in front of you. Any single result could, by chance, look meaningful.
• This page cannot tell you whether the site you are about to use stores passwords properly. A perfectly strong passphrase in a plain-text database is still exposed when that database leaks.
• Some login forms silently truncate long input or strip spaces. If a passphrase stops working after a password change, that is the usual cause.
• An acrostic always reduces strength. It is offered because a memorable passphrase you actually use beats a stronger one you reset every month, but the trade is real and the page shows it.