Four ordinary words, strung together, can be both easier to type than a jumble of symbols and harder to guess than most people expect. That's the whole appeal of a passphrase: it trades a short string of noise for a longer string of plain words, and gets a stronger password out of the trade.
Why word count beats word cleverness
A passphrase's strength comes from one number: how many words could have appeared in each slot, multiplied by itself once per word. This generator draws from a list of 1,266 everyday words, so each word you add multiplies the possibilities by 1,266. Four words gives you roughly 2 trillion combinations. Six words gives you a number with eighteen digits. The words themselves don't need to be exotic. The randomness of which four (or five, or six) get picked is what does the work, not how unusual any single word looks.
This is also why a phrase you invent yourself falls short. If you pick "correct horse battery staple" because you read about it somewhere, or "SunshineDog2019" because it means something to you, you've narrowed the field enormously. A real attacker isn't guessing random dictionary combinations blind; they're trying phrases people actually choose, which lean on the same handful of memorable words and the same personal facts. A generator has no such lean. It reaches into the full list with no preference for any word over another.
Putting a number on it
It helps to compare a passphrase against the kind of password most sites expect. A fully random password using upper and lower case letters, numbers and symbols has about 6.5 bits of unpredictability per character. Eight characters like that comes to roughly 52 bits. A five-word passphrase from this generator lands at almost exactly the same figure, around 51 bits, and a six-word phrase pulls ahead to nearly 62. So the common worry, that plain words must be weaker than a wall of symbols, doesn't hold once the word list is large enough and the picks are genuinely random. What actually determines the strength is length in words, same as it's length in characters for a normal password.
Where a passphrase earns its keep
Not every password needs to be typed by a human. Most of yours get pasted from a manager and never touched by your fingers, which is exactly where a dense random password belongs; the strong password guide covers that case, and the 12 and 15 character generator handles sites with a fixed length rule. A passphrase is for the small handful of secrets you actually have to type, over and over, usually from memory:
- Your password manager's master password. It's the one password that can never live inside the manager itself, so it has to be something your hands remember.
- Full-disk encryption on a laptop, which asks for the passphrase at every boot, sometimes before the rest of the system has even loaded.
- A shared device, like a family computer or a login at a shop counter, where a manager may not be signed in.
- A WiFi network guests will type by hand. The WiFi password generator can build one, or you can skip the typing entirely with a QR code that guests scan instead.
Making one your fingers will remember
Typing a phrase a few times does more for memory than staring at it. Say each word out loud as you type it, or picture the words as a short, slightly absurd scene: a tiger reading a ledger by lantern light sticks better than four words in isolation. It sounds silly, and it works anyway, because a strange little image is easier for a brain to hold onto than a string of unrelated nouns.
The separator matters more than people expect, too. Some login forms reject spaces outright, so this generator lets you choose a hyphen, an underscore, a dot, or a plain space, and you can switch it depending on where the passphrase is going. A hyphen between words also makes a long phrase easier to read back to yourself if you ever need to enter it on a device without a keyboard, like a smart TV or a game console.
Capital letters and a number, if you want them
Capitalizing each word doesn't add much mathematically, since an attacker who knows the generator's rules can assume it, but it does make a printed or handwritten copy easier to read at a glance, which matters if you've written the phrase down for a drawer or a safe. A number tacked onto the end is a little more useful: it's one more random choice layered on top of the words, and it costs almost nothing to remember since most people are used to a digit or two after a word anyway. Both options are switches on this page, on by default, and you can turn either off if a particular login form is picky about format.
How many words is enough
Four words is a reasonable floor for an everyday account. Five is a comfortable middle ground, and it's the right choice for anything that guards other passwords, such as a manager's master password. Six or more is worth the extra typing for full-disk encryption or anything you'd genuinely hate to have guessed. The slider on this page runs from three to eight words, so you can match the count to how much the phrase is protecting rather than using the same length everywhere.
The rest of the toolkit
A passphrase covers the words-you-type case, but it isn't the only tool worth knowing about here. The main password generator and the random string generator are better suited to anything pasted rather than typed, including API keys and tokens. Locks and keypads that only take digits are covered by the numeric PIN generator, and the strength check tab on the main generator will estimate how tough a password you already use would be to crack. If you're setting up accounts that get targeted often, it's worth generating fresh passwords for your email and social media logins specifically, since both tend to unlock a lot else if they're ever compromised.
Built in your browser, nowhere else
Every word is picked using your browser's Web Crypto API, the same secure random source used for real cryptographic work, not a plain random-number function. The selection happens inside this tab, and the word list itself, all 1,266 entries, ships with the page rather than being fetched from anywhere. Generating a phrase makes no network request; you can confirm that yourself by opening your browser's developer tools, switching to the Network tab, and pressing Generate. Copy the result somewhere safe, memorize it if it's a master password, and you're set.