FREE TOOL
Passphrase Generator
A free security tool from Bytes Unlimited. Strong, memorable passphrases built from the EFF Long Wordlist using cryptographic randomness — everything runs in your browser, nothing is sent to a server.
Made by Bytes Unlimited · Wordlist by EFF (CC BY 3.0)
Generator
Your Passphrase
Entropy
— bits · —
SETTINGS
More words = more entropy. Five is a strong default. Six or more is rock solid.
Modifiers
WHY PASSPHRASES
Long beats complex
A six-word passphrase is exponentially harder to crack than a typical "P@ssw0rd!" — and far easier to remember. EFF agrees (opens in new tab).
-
Cryptographic randomness
Words are picked with your browser's
crypto.getRandomValues()— the same source TLS uses. NoMath.random()in sight. -
7,776-word wordlist
Built on the EFF long wordlist — curated for memorability, no offensive words, all between three and nine characters long.
-
Stays in your browser
Generation happens entirely client-side. Your passphrase is never transmitted, logged, or stored on our servers.
HOW TO USE IT
Three steps, twenty seconds
The defaults above produce a strong passphrase. Tune to taste, then move on with your day.
-
Pick a length
Four words is the floor. Five is the sweet spot for most accounts. Six or more if it protects something that really matters — banking, work email, password-manager master.
-
Tune the format
Some sites still reject spaces — hyphens or periods are safe everywhere. Add capitals or a digit only if a site insists on them. Format does not meaningfully change strength; length does.
-
Save it to a password manager
Paste it into Bitwarden, 1Password, KeePass, Dashlane — whichever you use. Do not store it in a note, a sticky, or your browser's autofill alone.
UNDER THE HOOD
How this generator actually works
We built this the way we'd want our own clients' generators built. No tracking, no Math.random(), no surprises.
-
EFF Long Wordlist (7,776 words)
The Electronic Frontier Foundation's "long" wordlist — every word three to nine characters long, hand-curated to remove offensive terms, look-alikes, and rare vocabulary. Built specifically for human-memorable passphrases.Wordlist by EFF (opens in new tab), used under CC BY 3.0 (opens in new tab). Vendored locally — no third-party runtime dependency.
-
Cryptographic randomness
Words are picked with
crypto.getRandomValues()— the same CSPRNG your browser uses for TLS. Rejection sampling eliminates modulo bias when mapping random integers into the wordlist range. -
The entropy math
log₂(7,776) ≈ 12.92 bits per word. Five random words ≈ 65 bits — would take centuries of dedicated GPU cracking. Each extra word adds another ~13 bits, which doubles the search space twelve times over.
-
100% client-side
The wordlist and generator JavaScript ship inside this page. After the page loads, your browser makes zero network calls. Your passphrase is never transmitted, never logged, never stored on our servers.
BEST PRACTICES
A strong passphrase isn't the whole answer
A good passphrase is foundational, not the finish line. The rest is operational hygiene.
-
Unique per account
A breach at one site should never compromise another. Every account gets its own passphrase. This is the single highest-leverage habit.
-
Use a password manager
You can't (and shouldn't) memorize fifty unique passphrases. A password manager — Bitwarden, 1Password, KeePass — does that for you. Memorize one strong master passphrase; let the manager handle the rest.
-
Layer in MFA
Multi-factor authentication — Duo, an authenticator app, or a hardware key — turns a stolen passphrase into a non-event. Enable it everywhere it's offered.
-
Don't share over insecure channels
SMS, plain email, and Slack DMs are not safe places to send a passphrase. Use the password manager's secure-share feature, or share verbally / in-person.
-
Rotate after a breach, not on a calendar
Forced periodic password rotation is widely understood today as counterproductive — it pushes people toward weaker, predictable variants. Rotate on actual compromise, or when you have reason to believe a credential leaked.
-
A generator isn't a vault
This tool produces passphrases — it doesn't store them. Generate, copy, paste into your password manager, then walk away. Refreshing this page is the same as throwing away the previous suggestion.
COMMON QUESTIONS
Frequently Asked Questions
Why are passphrases stronger than complex passwords?
A typical eight-character "complex" password like P@ssw0rd! has roughly 40 bits of entropy and is sitting in every credential-stuffing wordlist on the planet. A five-word random passphrase pulled from the EFF list has ~65 bits — about thirty-two thousand times more search space — and is far easier for a human to remember and type. The classic illustration is xkcd #936 ("correct horse battery staple"); the math is what makes it work.
Do I have to memorize my passphrases?
No. The realistic answer is: memorize one strong passphrase — the master for your password manager — and let the manager generate and store the rest. The reason passphrases are popular for the master is exactly because human brains are good at remembering meaningful word sequences and bad at remembering character soup.
What if a site has a length limit or rejects spaces?
Switch the separator from space to hyphen or period — almost every length-limited site accepts those. If the maximum is short (say 16 characters), drop to four words and accept the lower entropy. If a site rejects passphrases entirely or caps at a tiny length, raise it as a complaint and use a password manager to store a long random password for that account instead.
Can I trust randomness coming from a browser?
Yes — when the page uses crypto.getRandomValues(), which this one does. That API is backed by the operating-system CSPRNG and is the same source TLS, WebAuthn, and password managers use. We deliberately do not use Math.random(); that's seeded predictably and is unsuitable for security work.
Does anyone see my passphrase?
No. Generation happens entirely in your browser after this page loads. There is no server-side endpoint, no analytics on this page, and no log of any passphrase that's ever been displayed. Hit refresh and it's gone for good.
Is this tool different from useapassphrase.com?
Same idea (passphrases from the EFF Long Wordlist), entirely original implementation. We built this tool from scratch for the Bytes Unlimited site — no code shared with useapassphrase.com — and rebuilt the generator to use cryptographic randomness end-to-end (crypto.getRandomValues() with rejection sampling) where the original relied on JavaScript's Math.random(). The wordlist itself is the same because there's only one canonical EFF Long Wordlist, published by the Electronic Frontier Foundation under CC BY 3.0 specifically so people can use it freely. No tracking, no third-party scripts, no runtime dependencies on other passphrase tools.
Need more than a passphrase?
We deploy enterprise MFA with Cisco Duo, configure password managers across teams, and harden Microsoft 365 and Google Workspace sign-in policies.