Passphrase Generator
Generate strong, memorable Diceware-style passphrases online. Choose 3-10 words from a 200-word list, separator, optional number & symbol. 100% browser-based using the Web Crypto API. No signup, no upload, unlimited.
Diceware-Style Security
Each word is drawn from a 200-word embedded list using `crypto.getRandomValues` — the same cryptographic primitive browsers use for TLS. Never Math.random().
100% Private & Offline
The full 200-word list is embedded directly in the page. No fetch, no server, no API call. The passphrase is generated entirely in your browser and never leaves your device.
Memorable & Strong
A 5-word passphrase from a 200-word list is ~38 bits of entropy — strong enough for most logins, and far easier to remember than a random string. Add a number or symbol for extra strength.
Fully Customizable
Word count 3-10, five separators (dash, underscore, dot, space, none), optional 4-digit number, optional symbol. One click to copy, one click to regenerate.
What is a Diceware passphrase?
A Diceware passphrase is a sequence of randomly-chosen words drawn from a fixed wordlist — originally chosen by rolling physical dice. The randomness makes it strong, while the words make it easy to remember. This tool uses the same idea with a 200-word embedded list and the Web Crypto API instead of dice.
How secure is a generated passphrase?
Entropy = wordCount × log₂(wordlistLength) + (number ? 13 : 0) + (symbol ? 5 : 0). With 5 words from a 200-word list you get ~38 bits; 7 words + number + symbol gets ~71 bits; 10 words + number + symbol gets ~94 bits. Aim for 60+ bits for important accounts.
Why use the Web Crypto API instead of Math.random()?
Math.random() is not cryptographically secure — its output can be predicted from internal state. `crypto.getRandomValues` draws from the operating system CSPRNG, which is unpredictable and suitable for passwords and secrets.
Is the wordlist fetched from a URL?
No. The 200-word list is embedded directly in the page JavaScript, so the tool is 100% offline and browser-based. There is no network request when you generate, copy, or change options. Nothing is uploaded, logged, or sent to any server.
Should I add a number and a symbol?
It depends on the policy of the site you are using. Many sites require a digit or symbol; appending one adds ~5-13 bits of entropy and satisfies those requirements while keeping the passphrase memorable.
Ready to use the Passphrase Generator?
Free, no signup, no watermark. 100% browser-based. Your data never leaves your device.
Open the tool