UtilibyWritten by the Utiliby editorial team · Last updated October 14, 2026 · Rules and formulas reviewed October 2026
What this free passphrase generator does
Complex passwords such as T7#kp9Lm are hard to remember and easy to mistype, so people reuse them or write them in unsafe places. A passphrase solves this. It joins several random words, for example Maple-Falcon-Lantern-River-Quilt, into something you can remember and type, yet its strength comes from the number of words and how randomly they were chosen.
This free online passphrase generator creates random passphrases in your browser using a secure random generator. You choose the number of words, the separator, capitals, digits and symbols, and it shows the exact strength in bits and the time it would take to crack. You can also use your own word list, and the strength is calculated from its size.
How to use the passphrase generator
- Choose the length. Seven words for most accounts with the built-in list, eight or nine for a master password.
- Pick a style. A hyphen or space separator is easy to type. Random digits or symbols between words add strength.
- Make passphrases. Press the button to get a new set. Copy one with its button.
- Check the strength. The bar and the bits show how strong it is, and the table gives crack times.
- Memorize and store. Say it aloud, picture the words, and save it in a password manager.
How passphrase strength is calculated
The strength of a passphrase comes from choice. If a list has 610 words and you pick 5 at random, there are 610 × 610 × 610 × 610 × 610 possible results, about 84 trillion. That is log base 2 of the total, about 46 bits. Every added word multiplies the possibilities again. The tool also adds the bits from any random digits, random symbols, random capitals and random separators you choose.
| Words (610-word list) | Entropy | Comparable random password |
|---|---|---|
| 4 | 37 bits | 6 characters |
| 5 | 46 bits | 7 characters |
| 6 | 55 bits | 9 characters |
| 7 | 65 bits | 10 characters |
| 8 | 74 bits | 12 characters |
| 10 | 92 bits | 15 characters |
This calculation assumes the attacker knows the word list and the style. That is the safe assumption, since real security should not depend on secrecy of the method.
Rules for a strong passphrase
- Let the tool choose. People pick words they like, in familiar patterns. Random choice is what gives strength.
- Do not edit the result. Swapping a word for a favorite one lowers the strength.
- Never use quotes, lyrics or sayings. They are in attackers' lists.
- Use at least seven words with the built-in list, and more for master passwords. A bigger word list lets you use fewer.
- One passphrase per account. Never reuse.
- Turn on two-factor authentication.
How to remember a passphrase
Make a mental picture in which each word appears in order, such as a maple tree with a falcon carrying a lantern across a river to a quilt. Say it aloud, then type it. Repeat the next day and the day after. The effort pays off quickly, because the same phrase is used often when it protects a password manager or a device. For the other passwords, let a password manager create and remember long random strings.
Where passphrases work best
- The master password of a password manager.
- Device and disk encryption that you type often.
- Encrypted files and archives. The Text Encryption and File Encryption tools on this site work well with a passphrase.
- Wi-Fi networks that others type in.
- Key and wallet recovery phrases that you must write down.
Some websites limit length or reject spaces. Choose the hyphen or no separator when that happens, and add digits or a symbol if a rule demands them.
Using your own word list
A bigger list makes each word stronger. The well-known diceware lists have 7,776 words and add about 12.9 bits per word. If you paste a list of 2,000 words, each word adds about 11 bits. Use words that are easy to spell and distinct from each other, avoid offensive words, and remove duplicates. The tool removes duplicates for you and refuses lists shorter than 100 words, since small lists give little strength.
Passphrase, random password or password manager?
These are not rivals. A password manager is the tool that makes it practical to have a different long random password for every account. A passphrase is the right choice for the few secrets you must remember without help: the manager's master password, your device login and an encryption password. A short random password is a poor choice for either job, because it is hard to remember and weaker per second of typing than a passphrase. Use the manager for the many, use a passphrase for the few, and add two-factor authentication to both.
How many words for which attacker
The right length depends on how the secret is stored. If a site locks you out after a few wrong tries, even a modest passphrase is hard to attack online. If a stolen database uses a slow password hash, an attacker can try thousands of guesses a second, and 50 to 60 bits is strong. If the hash is fast, as with old MD5 or SHA-1 storage, or if the secret protects an encrypted file that an attacker can copy, plan for trillions of guesses per second and aim for 70 bits or more. With the built-in list that means seven to eight words. Using a larger word list lets you reach the same strength with fewer words.
Privacy, limits and responsible use
Passphrases are created in your browser with its secure random generator. They are not sent, saved or logged, and they disappear when you close the page. The printed report leaves the passphrases out unless you tick the box. Paper copies can be seen by others, so handle them with care. This tool gives a guide to strength, but cannot guard against malware on your device or phishing, so keep your system updated and be careful where you type your passphrase.
Related free tools
Use these free online tools together with this one:
- Test how strong a password is with the password strength checker.
- Protect a message with the text encryption tool.
- Create a checksum or hash with the hash generator.
- Make a random password with the password generator.
- Memorise a passphrase or code words with the flashcard generator.
- Choose a username for a new account with the username generator.
Frequently asked questions
What is a passphrase?
A passphrase is a password made of several words, such as four to seven random words. It is easier to remember and type than a string of symbols, and can be just as strong.
How do I generate a passphrase for free?
Choose the number of words and options and press Make new passphrases. Copy the one you like. Each press creates a fresh set.
Are passphrases more secure than passwords?
A random passphrase of seven words from this list is about as strong as a random 10-character password with letters, numbers and symbols, and is much easier to remember. Both must be random and unique.
How many words should I use?
Seven or more with the built-in list, which gives about 65 bits. Use eight or nine for a password manager master password or an encrypted file. Five words give only about 46 bits, which a fast offline attack can crack, unless you paste a larger word list.
Are the passphrases truly random?
Yes. They use your browser's cryptographically secure random generator, with a method that avoids bias, and nothing is sent or stored.
Is it safe to use a generated passphrase?
Yes, as long as you use it for one account and keep it private. Do not change it into something more familiar, because that removes randomness.
What does entropy in bits mean?
It measures how many guesses an attacker needs. Each bit doubles it. 46 bits is about 70 trillion possibilities, and 65 bits is about 37 quintillion.
Does adding numbers or symbols help?
A little. Each digit adds about 3.3 bits, and a symbol about 3.8. Adding another word adds more, about 9.3 bits with the built-in list.
Why does capitalization add little?
If every word is capitalized the same way, an attacker can do the same. Only random capitalization adds a bit per word.
Can I use my own word list?
Yes. Paste at least 100 words and tick Use my own list. The strength is calculated from the size of your list. Longer lists give more strength per word.
How big is the built-in list?
It has 610 common, easy-to-spell words of four to eight letters, so each word adds about 9.25 bits. Bigger lists such as the EFF diceware list give more, so add words if you need more strength.
Does the attacker know my word list?
Strength figures assume they do. Real security should not depend on keeping the list secret.
Can I remember a passphrase?
Usually yes. Picture the words as a short story, say them aloud a few times and type them on first use and a day later.
Can I reuse a passphrase?
No. Reuse is the main way breaches spread. Use a different one for every important account.
What is the crack time based on?
On the average number of guesses for the entropy, at three attack speeds. Real attacks vary, so use it as a guide.
What does the print option include?
Your settings and strength. The passphrases are included only if you tick the box.
Is it free?
Yes. It is free to use online with no sign-up.
Sources and further reading
- EFF, Dice-Generated Passphrases and the Long Wordlist (eff.org).
- Reinhold, The Diceware Passphrase Home Page.
- UK National Cyber Security Centre, Three random words guidance (ncsc.gov.uk).
- NIST SP 800-63B, Digital Identity Guidelines (nist.gov).
- MDN Web Docs, Crypto.getRandomValues() (developer.mozilla.org).
Sources were consulted in October 2026. Standards and rules can change, so always check the official page for your situation.