Overview
Security advice and human memory are usually at war: we are told to create secrets nobody can guess, then we create secrets nobody can remember — including us — and the sticky note wins. Passphrases end the war. A short row of unrelated everyday words slips into memory with one reading, while remaining brutally expensive for a computer to guess, provided the words were chosen at random.
This generator handles the choosing so your own biases cannot sneak in. It draws between three and eight words from a plain, spellable word list using your browser's cryptographic random source, then lets you shape the result: pick a separator, set the capitalisation, and add a number if a site demands one. You get something you can type from memory that still carries serious entropy.
Why are random words so hard to guess?
Because the attacker does not know which words. If the word list holds a few thousand entries and you string five of them together, the number of possible passphrases is the list size raised to the fifth power — easily tens of bits of entropy per word. A dictionary attack cannot shortcut it, because there is no pattern to exploit: the words were not chosen to mean anything together.
The critical word is random. Five words you picked yourself — song lyrics, a quote, your street plus your dog — carry a fraction of the strength, because human choices cluster around the familiar. Letting the generator pick is not a convenience; it is the entire security argument.
Features
- Three to eight words per passphrase, adjustable to taste.
- Plain, spellable word list — no obscure vocabulary you will mistype.
- Separator options including spaces, hyphens and other dividers.
- Capitalisation control for sites with case requirements.
- Optional number appended when a form insists on a digit.
- Cryptographic word selection — every word drawn from a secure random source.
- Copy and regenerate in one click, all computed locally.
Benefits
- Actually memorable. A phrase you can picture beats a string you cannot.
- Typable under pressure. Ordinary words survive phone keyboards and tired fingers.
- Real, measurable strength. Word count translates directly into entropy.
- Private by construction. The words never leave your browser.
Who can use it
Anyone who needs a master password for a password manager — the single most important use case, since it must be both strong and memorised. Also ideal for Wi-Fi passwords shared with guests, encryption passphrases, and any account where you will type the secret regularly. If you have ever reset a password because you could not remember the “strong” one, this is your tool.
How to use
- Choose how many words the passphrase should contain — five is a good start.
- Pick a separator style and whether words are capitalised.
- Add a number if the site you are registering with requires a digit.
- Regenerate until you get a phrase that sticks in your mind.
- Copy it, store it in your password manager, and use it as your master secret.
Frequently asked questions
How many words do I need?
Five words from a multi-thousand-word list gives roughly 60+ bits of entropy — strong for everyday use. Six words pushes past 75 bits, suitable for a master password. Beyond six the gains are real but the memorability cost rises; for most people, five or six words is the sweet spot between security and sanity.
Is this the same idea as the famous “correct horse” comic?
Yes — that comic illustrated exactly this principle: four random common words carry more entropy than a short, complex-looking password, and they are far easier to remember. The math holds up. The only requirement the comic glossed over is that the words must be chosen by a random process, not by you — which is what this generator does.
Can I use my own words instead?
You can, but you should not. People pick words with meaning — lyrics, places, names — and those cluster in predictable ways that shrink the real search space. A generator has no favourite words. If a phrase it produces happens to amuse you, that is a bonus, not a selection criterion.
Will sites accept a passphrase with spaces?
Most modern sites do, and spaces count toward length requirements nicely. Some older forms reject spaces — that is what the separator options are for. Hyphens are accepted almost everywhere and keep the words visually distinct.
Should the passphrase be my only password?
Use it where memorability matters: your password manager's master password, your device unlock, your Wi-Fi. For the dozens of other accounts, let the manager hold unique random passwords. One strong memorable secret guarding many unmemorable ones is the whole strategy.
Does the generator record the words it picks?
No. Selection happens in your browser's memory with its secure random source, and nothing is transmitted or stored. The passphrase exists only on your screen until you save it somewhere.
Conclusion
The strongest password is the one you never have to reset. Let randomness pick the words, pick a phrase that sticks, and give your memory exactly one secret worth keeping.