Passphrase generator
Diceware passphrases from the EFF wordlists, with the entropy each option actually contributes rather than the entropy people assume.
Where the strength comes from
A passphrase gets its entropy from the size of the wordlist and the number of words, and from nothing else. Each word drawn from the EFF long list of 7,776 words contributes log2(7776) = 12.925 bits. Six words is 77.5 bits. The length of the resulting string is irrelevant; what matters is how many equally likely phrases the scheme could have produced.
That is why the two decorations people add are worth less than they look. Capitalising the first letter of every word adds nothing at all, because the rule is not secret and an attacker applies it too. Appending a digit adds log2(10) = 3.32 bits, and this tool counts the extra bits from choosing which word it attaches to as well. Even generously counted, it is worth about a quarter of one extra word.
| Words | EFF long (7776) | EFF short (1296) | Roughly equivalent to |
|---|---|---|---|
| 4 | 51.7 bits | 41.4 bits | 9 random alphanumeric characters |
| 5 | 64.6 bits | 51.7 bits | 11 random alphanumeric characters |
| 6 | 77.5 bits | 62.0 bits | 14 random alphanumeric characters |
| 7 | 90.5 bits | 72.4 bits | 16 random alphanumeric characters |
| 8 | 103.4 bits | 82.7 bits | 18 random alphanumeric characters |
The equivalence column uses 5.954 bits per alphanumeric character and rounds up to the next whole character.
Where the wordlists come from
Both lists are the EFF's, used verbatim and in their published order. The long list of 7,776 words is the Diceware standard, sized so that five six-sided dice select one word. The short list of 1,296 words is sized for four dice and was built with different priorities: every word is at most nine characters, and each is uniquely identified by its first three letters, which makes a phrase far easier to type correctly and to read to somebody over the phone.
Word selection here uses the same rejection sampler as every other generator on this site, so all 7,776 words are equally likely. A remainder would favour the earlier part of the list, which for an alphabetically ordered wordlist means favouring words beginning with the letter A.
Questions
Is a passphrase actually stronger than a password?
At the same length, no. At the same memorability, comfortably yes. Six words from the EFF long list is 77.5 bits, which you can hold in your head; a 13-character random password is about the same strength and you cannot. The comparison that matters is not passphrase against password, it is passphrase against the shorter password a person will actually remember.
Why does capitalising the first letter add nothing?
Because the scheme is not secret. An attacker who knows you capitalise the first letter of every word simply capitalises the first letter of every candidate. Entropy comes from choices an attacker cannot predict, and a rule applied to every word is not a choice. Random capitalisation per word would add one bit each, but then it is no longer memorable, which was the reason to use a passphrase.
What about adding a number or a symbol at the end?
One digit is 3.32 bits. Choosing which word to attach it to adds a little more, and this tool counts both. Even so it is worth less than one extra word, which is 12.9 bits from the long list. If a site forces you to include a digit, add one; if you are choosing freely, add a word instead.
Should I use the long list or the short one?
The long list is the Diceware standard and gives 12.925 bits per word. The short list gives 10.340 bits per word but its words are at most nine characters and each is uniquely identified by its first three letters, so it is easier to type and to read aloud. Use the short list where a human has to handle the phrase and the long list where it just goes into a password manager.
Can I use a passphrase for a disk or vault master password?
That is the case it is best suited to. A master password has to be memorised and typed, cannot be stored anywhere, and is attacked offline. Six or seven words from the long list gives 77.5 to 90.5 bits, which is a serious problem for an offline attacker when it sits behind a modern password hash.