Diceware Passphrase Generator

About this tool

The Diceware Passphrase Generator creates memorable passphrases by picking random words with the browser's cryptographically secure Web Crypto API instead of physical dice. Its built-in list has 258 common four-letter English words (able, acid, bank, cake…), so each word adds 8 bits of entropy: 4 words ≈ 32 bits, 6 words ≈ 48 bits, 8 words ≈ 64 bits and 10 words ≈ 80 bits. That is less per word than the 7,776-word EFF list used by classic Diceware (about 12.9 bits per word), so use more words for the same strength: 8 to 10 words for important accounts. Choose 4 to 10 words with the slider, a separator (space, hyphen, dot, underscore or none), and optionally capitalize words, add a two-digit number or add a symbol. The panel shows a strength label, the entropy in bits for the words alone, the word-list size and the approximate number of possible passphrases. Nothing leaves your browser.

Why use it

• Cryptographically secure random source via Web Crypto API — equivalent to rolling physical dice.

• Short, common four-letter words are easy to type and remember.

• The entropy readout shows how many bits your word count gives, so you can pick a length that matches the stakes.

• Separator, capitalization, number and symbol options help satisfy picky password rules.

How to use

1. Drag the Word count slider from 4 to 10 words (default 6); a new passphrase appears as you move it.
2. Choose a Separator: space, hyphen, dot, underscore or none.
3. Optionally tick Capitalize words, Add number (a two-digit number at the end) or Add symbol (one of !@#$%^&*).
4. Click Generate for a new passphrase; the strength, entropy and word-list size update below.
5. Click Copy to copy the passphrase to your clipboard.

When it helps

• Creating a master password for a password manager (Bitwarden, 1Password, KeePass) — must be both strong and memorable.
• Generating a passphrase for full-disk encryption (VeraCrypt, LUKS, FileVault, BitLocker recovery key).
• Setting a memorable SSH key passphrase.
• Creating account passwords that must be typed rather than copied.

Examples

Tips

• With this 258-word list, use 8 words (~64 bits) as a minimum and 10 words (~80 bits) for master passwords.
• Don't manually edit the passphrase — even small substitutions reduce entropy below the calculated bits.
• Memorize using visualization: turn the words into a vivid mental scene where each word interacts with the next.
• If the first passphrase has a word combination you dislike, generate again.
• Hyphens or dots are good separators for systems that don't allow spaces (some web forms, command-line flags).
• Turn on Add number and Add symbol only when a site insists on them; extra words add far more strength.
• Write the passphrase on paper only as a temporary memory aid; destroy the paper once you have it memorized.

Frequently Asked Questions

Glossary

Entropy (bits)

A measure of unpredictability. Each bit doubles the search space; 65 bits means ~3.7 × 10^19 possible passphrases — far beyond brute-force range for offline attacks at trillion-guesses-per-second.

EFF Large Wordlist

A 7,776-word wordlist published by the Electronic Frontier Foundation in 2016, designed for Diceware and curated for memorability, unambiguous spelling, and a minimum 3-character length per word.

Diceware

A passphrase-generation method invented by Arnold Reinhold in 1995 that selects words from a numbered list using dice rolls (or a CSPRNG) — five dice rolls give a 5-digit index into a 7,776-entry list.

CSPRNG

Cryptographically Secure Pseudo-Random Number Generator — a randomness source whose output cannot be predicted even with knowledge of past outputs; the Web Crypto API exposes a CSPRNG to browsers.

Brute-force attack

Trying every possible passphrase until the correct one is found. At 1 trillion guesses per second (current high-end offline rate), 65 bits of entropy takes ~877 years on average.

Passphrase strength

Often measured in bits of entropy; 60+ bits resists online attacks, 70+ resists most offline attacks, 80+ is considered safe against well-funded adversaries for the foreseeable future.

Master password

The single passphrase that decrypts a password manager's vault — the most critical secret a user owns. Aim for 80 bits or more, which is 10 words from this tool's list.

Web Crypto API

A modern browser standard (window.crypto) for cryptographic primitives; getRandomValues() returns truly unpredictable bytes suitable for key generation and secure passphrase creation.