Words Separator

↻

Ready

Press Generate to create a secret.

Randomness comes from crypto.getRandomValues, the same generator your browser uses for encryption keys. If your browser does not provide it, this tool refuses to run rather than fall back to something weaker. Word list: the EFF short word list (1,296 words), published by the Electronic Frontier Foundation under CC BY 3.0.

How strong is strong?

Strength is measured in bits of entropy: how many equally likely secrets the generator could have produced. Each word drawn from a 1,296-word list adds about 10.3 bits, so a six-word passphrase has roughly 62 bits, which means an attacker who knows exactly how it was made still faces around 4.7 quintillion possibilities. A 20-character random password using letters, digits and symbols carries about 130 bits, far beyond any realistic guessing attack.

The passphrase wins on memorability: six ordinary words are far easier to type and recall than 20 characters of line noise. Use passphrases for secrets you type by hand, like your computer login or password manager master password, and random passwords for everything a password manager fills in for you.

Why generating in a browser is fine here

The usual worry about online generators is that the site sees your new password. This page cannot: generation happens entirely in your browser using its built-in cryptographic random number generator, the result is never put in a URL, a cookie, or a request, and there is no analytics call wrapping the tool. You can verify that with your browser's developer tools; the network tab stays quiet when you press Generate. For extra caution, load the page, disconnect from the internet, and generate offline.

Password generator FAQ

How many words should my passphrase have?

Six words from this list is a sensible default for anything important, and it is the minimum the EFF suggests for this list. Four or five words are acceptable for low-value accounts that also have two-factor authentication. Go to eight or more for secrets that protect everything else, such as a password manager master password or disk encryption.

Is a passphrase of real words not easier to guess?

Not when the words are chosen randomly. The strength calculation already assumes the attacker has the full word list and knows the exact number of words; the only thing protecting you is the number of combinations, and that number is astronomically large. What is weak is a phrase you made up yourself, because humans pick predictable words in predictable orders.

Does ROOT VPN see the passwords this page generates?

No. The generator runs entirely in your browser and this page makes no network request that could carry a generated secret. Nothing is logged, stored, or transmitted. You can confirm this in the network tab of your browser's developer tools, or by generating with your connection switched off.

Should I still use a password manager?

Yes. The realistic threat to most people is not a supercomputer guessing one password, it is one leaked password being reused on twenty sites. A password manager gives every account its own random password, and a strong passphrase from this page makes a good master password to protect the manager itself.

Strong passwords protect accounts. A VPN protects the connection.

ROOT VPN encrypts your traffic on any network, with no activity logs. Free to start, unlimited data, no card needed.

Get ROOT VPN, free