Click generate to create a passphrase
Base dictionary: 35579 words. Total: 35579 words
Entropy
0 bits
Online Attack (avg)
0 seconds
1,000 guesses/sec
Offline Attack (avg)
0 seconds
H100: 158B hashes/sec
Cloud GPU (H100) Attack Scenarios (Average Time)
Brute Force (unknown pattern)
Tries all character combinations
Dictionary Attack (known wordlist)
Word combos × separators × caps × numbers × specials
H100 GPU: 158B hashes/sec @ $2/hour. Times shown are average case (half keyspace) - the expected time to crack, assuming the password is found halfway through all possibilities. Dictionary attack assumes attacker knows your wordlist but must still try all separator, capitalization, number, and special character variations.
Why This Works
Traditional passwords like "Tr0ub4dor&3" are hard to remember but easy to crack (~28 bits of entropy).
Passphrases like "correct horse battery staple" are easy to remember and hard to crack (~44 bits of entropy with 4 words).
Tip: Use a password manager to store your passphrases securely. This generator is perfect for creating a memorable master password.
The XKCD 936 Method
XKCD comic #936 revolutionized how we think about password security. The traditional approach of using complex but short passwords like "Tr0ub4dor&3" creates passwords that are:
- ×Hard for humans to remember
- ×Easy for computers to crack (~3 days)
- ×Only ~28 bits of entropy
Instead, using random common words like "correct horse battery staple" creates passphrases that are:
- ✓Easy for humans to remember
- ✓Hard for computers to crack (550 years)
- ✓~44 bits of entropy with 4 words
Why Length Beats Complexity
Each additional word exponentially increases security:
*Estimates based on H100 GPU (158B guesses/sec) attacking a properly hashed password
View the Original XKCD Comic
Learn more about password strength and the inspiration behind this generator by reading XKCD comic #936.
View XKCD 936Understanding Password Entropy
Entropy measures the unpredictability of your password in bits. Each additional bit doubles the number of possible combinations an attacker must try. Higher entropy means better security.
Entropy Calculation for Passphrases
For a passphrase generated from a wordlist, entropy is calculated as:
Example with our base wordlist (7,776 words):
- • 1 word = log₂(7776) ≈ 12.9 bits
- • 4 words = 12.9 × 4 ≈ 51.6 bits
- • 6 words = 12.9 × 6 ≈ 77.5 bits
Weak Security
Crackable in seconds to minutes. Never use.
Vulnerable to dedicated attacks. Avoid.
Strong Security
Secure against modern attacks. Good for most accounts.
Extremely secure. Recommended for critical accounts.
Important Note: Dictionary Attacks
If an attacker knows you used this generator and has access to the wordlist, they can perform a more efficient dictionary attack instead of brute force. This is why we provide two crack time estimates:
- Brute Force: Attacker tries all possible character combinations (assumes unknown pattern)
- Dictionary Attack: Attacker knows the wordlist and tries word combinations (still must guess separator, capitalization, numbers, and special characters)
Even with dictionary knowledge, a well-configured passphrase (5+ words with numbers/special chars) provides strong security.
Password Best Practices
Do This
- ✓Use a password manager to generate and store unique passwords for every account
- ✓Enable 2FA/MFA on all accounts that support it for an additional security layer
- ✓Use 5-6 word passphrases for your password manager master password
- ✓Add numbers and special characters for accounts requiring them
- ✓Check for data breaches at haveibeenpwned.com and change compromised passwords
Don't Do This
- ×Reuse passwords across multiple sites - one breach compromises all accounts
- ×Use personal information like names, birthdays, or addresses in passwords
- ×Use common passwords like "password123" or "qwerty"
- ×Share passwords via email, text, or other insecure channels
- ×Write passwords on sticky notes or unencrypted documents
Frequently Asked Questions
Find answers to common questions
Related Security Tools
Need Help Securing Your Organization?
Our cybersecurity experts can help you implement enterprise password policies, multi-factor authentication, and comprehensive security awareness training.
All passphrases are generated locally in your browser. Nothing is sent to our servers or stored anywhere. Your security is our priority.