Passphrase Generator
Generate secure, memorable word-based passphrases with custom word count, separator, and casing — instantly inside your browser.
What is a passphrase?
A passphrase strings together several random words instead of random characters — an approach popularized by the "diceware" method. Because each word is chosen randomly from a large word list, a passphrase of a handful of words can be both easier to remember and type than a random character password, while still having comparable or greater entropy.
This tool picks each word using the browser's cryptographically secure random number generator, drawing from a list of over 2,000 common English words, with control over word count, separator, and letter casing.
GuideHow to use it
How the passphrase is generated
Each word is picked independently using crypto.getRandomValues — the same cryptographically secure random source browsers use for security-sensitive code — from a word list of over 2,000 common English words. More words means more entropy: each additional word multiplies the number of possible passphrases by the size of the word list.
Features & benefits
Why this runs entirely in your browser
A passphrase generated on a server could theoretically be logged or intercepted in transit, so this tool generates every passphrase locally using the Web Crypto API, and nothing is ever sent over the network.
Common uses
Creating a memorable master password for a password manager, generating a passphrase for full-disk encryption or a Wi-Fi network, or setting up a recovery phrase-style secret that's easier to write down and remember than a random string of characters.
Frequently asked questions
A few things people usually want to know before trusting the numbers.
It can be. A passphrase of 5-6 words from a large word list has comparable or greater entropy than many random character passwords, while being much easier to remember and type.
5 or more words is a good default for most accounts. Each additional word adds roughly 8 bits of entropy, so longer passphrases get exponentially harder to guess.
It adds a bit of extra entropy and satisfies password rules that require at least one digit, without meaningfully hurting memorability.
Each word is chosen using crypto.getRandomValues, the browser's cryptographically secure random number source — not the weaker Math.random().
No. Passphrase generation happens entirely in your browser. Nothing generated here is sent to a server, stored, or shared.