Diceware Passphrase Generator

Real-world use cases

• Create a master password you can actually type from memory

  Your password manager's master password is the one credential you can never store in the manager itself — you have to remember it and type it on a phone, a locked-out laptop, a friend's machine. A random 20-char string is unforgiving here. Instead: pick English mode, 6 words, hyphen separator, leave extras off. You get something like `cedar-violet-mantle-quartz-ember-trout` — 62 bits, "Strong", and you can rehearse it three times tonight and have it for life. Type it into your manager's master field, then close this tab. The passphrase was never saved or sent anywhere.

• Generate a Wi-Fi / IoT password the family won't fight with

  A guest Wi-Fi password of `xK9#mq$2Lp!` gets read wrong off the fridge sticky note every single time, and visitors give up. Generate a 4-word passphrase with "Append a random digit" on: `garden-rocket-pillow-lemon7`. It reads cleanly across a room, types on a TV remote without rage, and at ~42 bits it's far past anything a drive-by attacker brute-forces against WPA2. Write the four words on the sticky note in plain language and nobody mistypes it.

• Seed a recovery phrase for a shared team vault

  You're setting up a break-glass credential for a team secrets vault and it has to be spoken over a phone call during an incident, not pasted. Use 7 words, space separator, capitalize each word: `Harbor Velvet Cinder Maple Otter Quartz Drift`. Over the phone you spell each word once; the recipient reads it back. At ~72 bits it's strong enough for a vault root, and "spell seven dictionary words" beats "spell H, capital-K, dollar-sign, nine…" when latency and stress are working against you.

• Make per-service passphrases without a manager

  You refuse to install a password manager but still want unique credentials per site. Generate a fresh 5-word passphrase for each account (`bronze-meadow-saddle-twine-pelican`), write it in a paper notebook you keep at home, and move on. Each is ~52 bits — strong, memorable enough to retype occasionally, and because every one is independently random, a breach of one site tells an attacker nothing about the others. The notebook stays offline; the passphrase never touches the URL or any server.

• Demonstrate entropy to a security-skeptical colleague

  Someone on your team insists `P@ssw0rd2024!` is "complex enough." Open this tool next to a password strength checker. Show them a 6-word passphrase reads 62 bits / centuries-to-crack while their 11-character l33t password reads ~36 bits and is in every breach dictionary. Toggle the word count up and down and watch the entropy number move by ~10.3 bits per word — a live, honest illustration of why length-from-randomness beats character-soup. The per-word bits readout makes the math impossible to hand-wave away.

Common pitfalls

• Capitalizing the first letter (or adding a predictable "1!" suffix) does NOT meaningfully raise entropy — an attacker assumes those transforms. This tool intentionally does not count capitalization toward the bits readout. Real strength comes from more words. If you want a capital for a site that demands "must contain uppercase", fine, but add a word too.

• Reusing the same passphrase across sites is still reuse. A 6-word passphrase is strong against brute force, but if you type it into a phishing page or a breached site stores it in plaintext, length doesn't save you. Generate a fresh one per high-value account.

• Don't "improve" the output by hand. People shuffle the words or swap a letter for a symbol to feel safer, but hand-edits cluster around predictable patterns and can lower the effective entropy. Trust the random draw; if you want more strength, increase the word count, which is exactly +10.34 bits each (English).

Privacy