How to make a memorable passphrase
- Choose the number of words. Five is a good default. Each extra word multiplies the number of possible passphrases by 7,776.
- Pick a separator. Dashes or spaces are easiest to type. Some sites don't allow spaces, so dashes are the safe choice.
- Add capitals and a number if the site has character rules. Then make up a quick mental image linking the words, and you'll remember it in minutes.
Why random words beat clever passwords
Humans are bad at randomness. Passwords people invent follow patterns, like a word, a capital at the start and a number or symbol at the end, and cracking tools try those patterns first. A diceware passphrase is different: every word is drawn at random from a known list of 7,776 words, so its strength can be calculated exactly and doesn't depend on the attacker not knowing the method.
- 4 words – about 52 bits. Fair for low-value accounts.
- 5 words – about 65 bits. Strong for most accounts.
- 6 words – about 78 bits. Great for a password manager or device login.
- 7+ words – 90 bits and up. Suitable for encryption keys you must type.
Where passphrases work best
Use passphrases for the handful of secrets you have to remember: your password manager's master password, your computer or phone login, full-disk encryption and Wi-Fi networks you share with guests. For everything else, let a password manager store a random password for you.
More free tools
What is a passphrase?
A passphrase is a password made of several random words, like Glider-Mousy-Umbrella7-Pantry-Eclipse. Because the words are chosen at random from a large list, it is as strong as a long random password but much easier to remember and type.
How many words should my passphrase have?
Five words from the 7,776-word EFF list give about 65 bits of entropy, which is strong for almost any account. Use six or seven words for your password manager master password or full-disk encryption.
Where do the words come from?
We use the EFF large word list, made by the Electronic Frontier Foundation for diceware passphrases. It contains 7,776 common, easy-to-spell words with no offensive or confusing entries.
Does adding capitals and a number make it stronger?
Capitalizing every word adds no real strength, since an attacker can assume it, but it helps with sites that require uppercase letters. Adding a number to a random word adds a few bits and satisfies "must contain a digit" rules.
Is a passphrase better than a random password?
For passwords you have to remember, yes. For everything a password manager fills in for you, a long random password packs more strength into fewer characters.
Is my passphrase sent anywhere?
No. The word list is downloaded once and every passphrase is put together in your browser with a cryptographically secure random source. Nothing is sent to our server.