How to make a strong passphrase
A passphrase is a password made of several random words, like maple-brave-comet-juggle-river-ladder. It is strong for one reason only: the words are chosen at random from a known list, so an attacker has to try every possible combination. That is the idea behind Diceware, where you roll five dice to pick each word from a list of 7,776 (6⁵) words. This generator does the same with your browser’s cryptographically secure random number generator instead of dice.
- Choose the number of words. Six is a good default for important accounts; see the table below.
- Pick a separator. Hyphens, dots and underscores avoid problems on sites that strip spaces.
- Turn on capital letters or a digit only if a site insists on them — they add little strength (a digit adds about 3.3 bits; capitals add nothing because every word is capitalised).
- Generate a few passphrases and take one exactly as it is. Swapping words for ones you like better makes it less random.
- Save it in a password manager, and use a different passphrase for every account.
How many words do you need?
Strength is measured in bits of entropy: each extra bit doubles the number of possible passphrases. With words picked at random from a list of N words, every word adds log2(N) bits. This generator uses 1,630 words (about 10.7 bits per word, 5.6 letters per word on average). The EFF’s long Diceware list has 7,776 words (about 12.9 bits per word, 7.0 letters on average).
| Words | This generator (1,630 words) | EFF long list (7,776 words) | Typical length here |
|---|---|---|---|
| 3 | 32.0 bits | 38.8 bits | ≈ 19 characters |
| 4 | 42.7 bits | 51.7 bits | ≈ 25 characters |
| 5 | 53.4 bits | 64.6 bits | ≈ 32 characters |
| 6 | 64.0 bits | 77.5 bits | ≈ 39 characters |
| 7 | 74.7 bits | 90.5 bits | ≈ 45 characters |
| 8 | 85.4 bits | 103.4 bits | ≈ 52 characters |
Length includes hyphens between the words. Entropy = words × log2(list size).
The EFF recommends six words from its long list for most uses, about 77 bits. With the shorter list used here, seven words (74.7 bits) come close and eight words (85.4 bits) go beyond it. For a password-manager master password or full-disk encryption, use at least seven words.
These numbers assume the attacker knows the exact word list and your settings. That is deliberate: the strength comes from the random choice, not from keeping the method secret.
How long would it take to guess?
An attacker who knows the list needs on average half of all combinations, 2^(bits − 1) guesses. How fast they can guess depends on where the password is attacked. The famous xkcd comic “Password Strength” assumed 1,000 guesses per second against a weak online service. If a site’s password database is stolen and the passwords are stored with a fast hash, attackers can try far more guesses per second offline; slow password hashes such as bcrypt or Argon2 cut that rate dramatically. The table uses two illustrative rates, not measured benchmarks:
| Words | At 1,000 guesses/second | At 10 billion guesses/second |
|---|---|---|
| 3 | about 25 days | under 1 second |
| 4 | about 112 years | about 6 minutes |
| 5 | about 182,000 years | about 7 days |
| 6 | about 300 million years | about 30 years |
| 7 | about 480 billion years | about 48,000 years |
| 8 | about 790 trillion years | about 79 million years |
Average time = 2^(bits − 1) ÷ guesses per second. Illustrative rates; real attack speeds vary enormously with hardware and how the site stores passwords.
The pattern matters more than the exact numbers: every extra word multiplies the attacker’s work by 1,630. Going from five to six words turns about a week into about 30 years at the faster rate.
For comparison, the xkcd passphrase “correct horse battery staple” is four words from a 2,048-word list, 4 × 11 = 44 bits, which the comic put at 550 years at 1,000 guesses per second.
Passphrase or random password?
A random password using all 94 printable keyboard characters gets about 6.55 bits per character. Both kinds are strong when they are truly random — the difference is how easy they are to type and remember:
| Random password | Entropy | Roughly equal to |
|---|---|---|
| 8 characters | 52.4 bits | 5 words here (53.4 bits) |
| 10 characters | 65.5 bits | 6 words here (64.0 bits) |
| 12 characters | 78.7 bits | 6 EFF words (77.5 bits) or 7 words here (74.7 bits) |
| 16 characters | 104.9 bits | 10 words here (106.7 bits) or 8 EFF words (103.4 bits) |
Random password entropy = length × log2(94).
Current guidance favours length over symbols. NIST’s Digital Identity Guidelines (SP 800-63B, revision 4, August 2025) say a password used on its own should be at least 15 characters (8 when it is one factor of multi-factor login), that services should allow at least 64 characters, that they must not force mixes of upper case, digits and symbols, and that they must check new passwords against lists of common and breached passwords. A six-word passphrase of about 39 characters fits comfortably within those rules.
Use a random password where you never type it yourself (the password manager fills it in), and a passphrase where you have to remember or type it: the password manager’s master password, your computer login, Wi-Fi and disk encryption.
Mistakes that weaken a passphrase
- Choosing the words yourself, or picking a song lyric, quote or saying. People are predictable, and attackers try phrases like these first.
- Regenerating until you get words you like. Every rejection makes the result less random; take one of the first few results.
- Using too few words. Three or four words are fine for a low-value game account, not for email, banking or a password manager.
- Reusing a passphrase. If one site is breached, attackers try the same login on other sites, so every account needs its own.
- Relying on the passphrase alone. Turn on two-factor authentication wherever it is offered.