Passphrase Generator

When a Multi-Word Passphrase Is Better Than a Random Password

While dense random character strings (like k9#mP2$vL7!nQ4) are ideal when your password manager autofills them for you, there are critical credentials you must type manually from memory: your password manager master password, your laptop's full-disk encryption login (BitLocker, FileVault, or LUKS), your desktop OS account, and shared Wi-Fi network credentials. Multi-word passphrases solve this by combining high mathematical entropy with effortless human memorability.

National cybersecurity authorities across North America and Europe — including US NIST SP 800-63B, the Canadian Centre for Cyber Security (CCCS), and the UK National Cyber Security Centre (NCSC "Three Random Words" guidance) — explicitly recommend multi-word random passphrases for human-memorized secrets. Learn more in our guides on what a passphrase is and how to create a strong password.

Passphrase Entropy & Offline Crack-Time Reference Table

In a standard Diceware-style cryptographic word list of 7,776 distinct words, each randomly chosen word contributes 12.925 bits of entropy (log₂(7776) ≈ 12.925), and adding capitalization plus a random number adds another ~10+ bits. Below is how word count determines total entropy and offline GPU crack resistance (at 100 billion guesses/sec):

3-Word NCSC vs. 4-Word, 5-Word & 6-Word EFF Diceware Passphrase Guide

Direct Answer: Use a 3-word random passphrase (~48.8 bits with capitalization and a digit) for low-risk rate-limited logins under UK NCSC Cyber Essentials rules, a 4-word to 5-word passphrase (61.7–74.6 bits) for everyday logins and Wi-Fi networks, and a 6-word+ Diceware passphrase (87.5+ bits) for password manager master vaults and full-disk encryption.

3-Word Passphrase Generator (UK NCSC "Three Random Words" Standard)

The UK National Cyber Security Centre (NCSC) popularized the "Three Random Words" policy because three unrelated words (such as Velvet-Orbit-glacier9) are far longer and harder to guess than human-created complex strings like Pa$$w0rd1!. Use 3-word passphrases only for online services protected by strict login rate-limiting or multi-factor authentication.

4-Word & 5-Word EFF Diceware Passphrase Generator (Master Passwords & Wi-Fi)

Following the Electronic Frontier Foundation (EFF Large Wordlist, 65 = 7,776 memorable words) and Canadian CCCS ITSP.30.030 guidance, a 4-word or 5-word passphrase provides 51.7 to 74.6 bits of cryptographic entropy while remaining effortless to type on smartphones, smart TVs, and WPA3 Wi-Fi routers.

6-Word to 10-Word High-Entropy Passphrases (BitLocker, FileVault, LUKS & SSH Keys)

When an attacker can capture an encrypted file or disk image and run offline GPU cracking without rate limits — such as your Bitwarden / 1Password / KeePassXC master vault, Windows BitLocker, macOS FileVault, Linux LUKS, or an SSH/PGP private key — generate a 6 to 8-word passphrase (77.5 to 113.4+ bits of entropy).

How Our Browser-Only window.crypto.getRandomValues() Passphrase Generator Works

Human brains are poor sources of randomness: when asked to pick "four random words," people unconsciously choose words related to objects in the room or common idioms. Our passphrase generator removes human bias entirely while keeping your phrase 100% private:

• Cryptographic Word Selection: Each word index is selected independently inside your browser tab using window.crypto.getRandomValues(new Uint32Array(...)), backed by your operating system's hardware random number generator.
• Custom Separators, Capitalization & Digits: You can join words with hyphens (-), spaces, periods (.), or underscores (_), capitalize initial letters, and append a cryptographically random number to satisfy legacy website complexity rules without sacrificing readability.
• Verifiable Client-Side Privacy: Open your browser's Developer Tools (F12 → Network tab) and click Regenerate. Zero network requests are sent, and your passphrase is never saved to cookies, localStorage, or server logs.

Frequently asked questions