Passphrase generator — strong, memorable random passphrases

Generate a secure passphrase from the standard EFF word list (7,776 words) using cryptographically secure randomness. Every word is chosen on this device — the passphrase you generate is never sent to a server, logged, or stored anywhere.

Private by default: generation happens entirely in your browser tab. The word list is a static file; no account, no network request carries your passphrase, and nothing is saved when you close the page.

Generate a passphrase

Ready. Choose your options and press Generate passphrase.

How it works

Three deterministic steps, all computed in this tab:

Pick words. Each word is chosen uniformly from the EFF large wordlist (7,776 common, easy-to-spell words) — the same list used by many Diceware-style tools. Words are drawn without replacement, so a word never repeats inside one passphrase.
Use real randomness. The index into the word list comes from crypto.getRandomValues with rejection sampling, which removes modulo bias. This is cryptographic-grade randomness, not Math.random().
Estimate strength honestly. Each word from a 7,776-word list contributes log₂(7,776) ≈ 12.9 bits of entropy. Because words are drawn without replacement, a six-word passphrase has about 77.5 bits — the estimate shown on the page uses exactly this calculation.

Worked example: with six words and hyphens you might get jigsaw-bunker-sunrise-quill-tango-zephyr — easy to type, easy to remember, and far stronger than a short character-jumble password.

Why passphrases beat short passwords

Password-cracking tools work by guessing: short, predictable passwords fall to dictionary and brute-force attacks in seconds or minutes. A passphrase's strength comes from length plus randomness — a long string of random words has a huge search space while remaining practical to type on phones, TVs, and keyboards. The trade-off is real: use a passphrase that is random (not a quote or song lyric), unique per account, and stored safely.

Limits

Not a password manager: this tool generates a random secret and displays it once. It does not store, sync, or autofill passphrases — keep the copy you made somewhere safe.
Entropy assumes true randomness: the estimate is exact only if your device's random source is working correctly and the options stay as chosen. Re-using a generated passphrase across sites undoes its strength.
No guarantee of uniqueness: any random generator can in principle repeat an output. Check passphrase strength and uniqueness with your own tools if the account is critical.
Word list: EFF large wordlist by the Electronic Frontier Foundation, CC BY 3.0.

Frequently asked questions

What is a passphrase and why use one?

A passphrase is a password made of several random words, such as 'correct-horse-battery-staple'. Because each word contributes roughly 12.9 bits of entropy, a six-word passphrase from a 7776-word list has about 77 bits of strength while staying far easier to type and remember than a random jumble of characters.

Are my generated passphrases sent anywhere?

No. This is a static page: the word list is loaded into your browser and every random choice is made on your device. Generated passphrases are never sent to a server, logged, or stored — you can refresh or close the tab and nothing remains.

How is the randomness generated?

The page uses the Web Crypto API (crypto.getRandomValues) with rejection sampling, which produces a uniform, unbiased index into the word list. This is the same class of randomness used for keys and tokens, and is stronger than Math.random(), which is not designed for secrets.

Is a generated passphrase enough to secure my account?

Strength is only part of the picture. Use a unique passphrase per account, store it in a password manager if you use one, and keep your devices updated. This tool generates a random secret; it does not manage, store, or sync passphrases for you.

Document Hygiene — inspect and scrub metadata from documents and photos before sharing them.
Text Hygiene — inspect invisible Unicode characters and review writing patterns locally.
RAG Cleaner — clean text and HTML into deterministic Markdown and chunks, browser-local.

Part of Local Toolworks. Last reviewed: 2026-08-16.