Passphrase
Passphrases: strong passwords you can actually remember
k7#Rq9!vLm2$Xw4p is strong – but nobody can remember it or type it on a phone without mistakes. A passphrase of random words is just as hard to guess and stays in your head after a few days. Here is how passphrases work and how many words you need.
The Password Generator picks words at random from a list of 4,096 words and shows exactly how strong the result is. Note: the word list is German – perfect if you want words most English-speaking attackers would never try first.
Generate a passphraseThe short version
- In the Password Generator, switch to Passphrase.
- 5 words for normal accounts, 6–7 words for a master password, computer login or encryption.
- Separator and capitalization to taste; “Append a number” only if a site requires it.
- Don’t pick or reorder the words yourself – randomness is what makes it secure.
The principle: randomness, not a sentence
A passphrase consists of several randomly chosen words. The method is known as Diceware: originally you rolled five dice and looked up the matching word in a list of 7,776 entries. The generator does the same with your browser’s random number generator – faster and just as unpredictable.
The key difference to a made-up sentence: “I love walking in the woods” is long, but attackers know typical sentence patterns and common word sequences. Random words have no connection that could be predicted – that is why their strength can be calculated exactly.
About the word list: our generator uses 4,096 common German words of 4 to 8 letters, without umlauts, so they work on any keyboard. If you prefer English words, the EFF publishes an English word list for dice; the math below applies to any random word list.
How many words do I need?
Every word from a list of 4,096 entries adds exactly 12 bits of randomness. Against an attacker making 10 billion guesses per second:
| Words | Entropy | Average time to crack | Good for |
|---|---|---|---|
| 4 | 48 bits | about 4 hours | only with 2FA or a lockout after failed attempts |
| 5 | 60 bits | almost 2 years | normal online accounts |
| 6 | 72 bits | several thousand years | master password, email, computer |
| 7 | 84 bits | millions of years | encryption, backups, crypto wallets |
Online accounts are additionally protected by lockouts after failed attempts; the table describes the worst case of a stolen database. With the EFF’s 7,776-word list, each word adds about 12.9 bits.
Five or six words, any separator you like – and regenerate until you get a combination that sticks.
Separators, capitals, numbers
- Separators: hyphens or dots are the easiest to type. “Random digit” adds a little extra strength per gap and satisfies the digit rule of many sites.
- Capitalization: “Capitalize words” reads best. “One word in capitals” adds a little strength.
- Appending a number or symbol: only if a site requires it. An extra word adds far more security.
- Spaces work, but some services trim or reject them.
How to memorize it
- Build a story: connect the words into a vivid, absurd scene. The stranger, the better it sticks.
- Regenerating is fine: if you don’t like a combination, create a new one. Swapping or sorting words yourself is not.
- Type it often during the first days – and keep it in your password manager or on paper in a safe place until then.
When a passphrase makes sense
Master password
The one password that unlocks your password manager – worth 6 to 7 words.
Computer and phone
Computer login, FileVault or BitLocker: everything you type by hand every day.
Wi-Fi
Guests can type a passphrase easily – or turn it into a Wi-Fi QR code.
For others
Initial passwords for family or colleagues can be read out over the phone without “capital Q, lower-case l…”.
Generate a passphrase
Random words, separators, capitalization and an optional number or symbol – with an exact strength meter. Free and local in your browser.
Frequently asked questions
How secure is a passphrase?
With random words it can be calculated exactly: every word from a list of 4,096 adds 12 bits. Five words give 60 bits, six words 72 bits – more than a random 10-character password using all character types.
How many words should a passphrase have?
At least five for normal accounts, six to seven for master passwords, computer logins and encryption.
Can I choose the words myself?
Better not. Self-chosen words follow patterns attackers know. You can regenerate as often as you like until you find a combination you like.
Which language are the generated words in?
German. The list contains 4,096 common German words without umlauts. The strength calculation is the same for any random word list.
What is Diceware?
A method from 1995 that uses dice to pick random words from a list. The Password Generator uses the same principle with the browser’s random number generator.
Do all websites accept passphrases?
Most do. Some limit the length or require digits and symbols – that is what the “Append a number” and “Append a symbol” options are for.
Sources
- Diceware, Wikipedia – the method introduced by Arnold G. Reinhold in 1995.
- EFF Dice-Generated Passphrases, Electronic Frontier Foundation.
- NIST Special Publication 800-63B – Digital Identity Guidelines: Authentication, National Institute of Standards and Technology.