Somewhere along the way, password advice split into two bad options. Security people told you to use long random strings like X9#mQ2$vL8!pR, and your brain responded by writing them on sticky notes. The other camp said "just use a memorable phrase," and attackers responded with dictionaries full of song lyrics and sports teams. A real passphrase generator resolves the standoff: it produces phrases that are easy for you to hold in memory and brutal for a computer to guess, because every word is drawn from a measured, published word list.
The Math Behind Why Passphrases Work
Password strength comes from entropy — roughly, how many guesses an attacker needs. A random eight-character password built from letters, digits, and symbols carries about 50 bits of entropy. That sounds like a lot until you know modern GPUs can test tens of billions of candidates a day.
A passphrase made of six random words from the EFF's large word list draws from 7,776 possibilities per word. Six words means 7,776⁶ combinations — a number with 23 digits. That is roughly 77 bits of entropy, and the gap between 50 and 77 bits is not incremental; each extra bit doubles the attacker's workload. Seven words pushes past 90 bits, which is out of reach for any brute-force effort on record, now and for the foreseeable future.
The asymmetry is the point. Humans are bad at remembering random characters and good at remembering words, because words attach to images and stories. Attackers exploit the opposite: they are good at trying every character combination and bad at guessing which random words you drew. A passphrase bets on your strength and their weakness at the same time.
The EFF Word List and Dice Math
The Electronic Frontier Foundation published its passphrase word lists in 2016, and they became the de facto standard for a reason. Each list entry is a common, unambiguous English word — no homophones, no obscure spellings, no two words that sound alike. You can read the result aloud once and type it from memory an hour later.
The lists are designed around dice. Roll five dice, and the 7,776 outcomes map to one word each. Roll again, get the next word. This matters because dice are the gold standard of auditability: you do not have to trust any software's random number generator, including ours. The Dice Roller tool online works fine for casual use, and the generator itself uses your browser's cryptographic randomness — the same crypto.getRandomValues API that browsers reserve for security-sensitive work — to draw words with equal probability.
Using the Passphrase Generator Step by Step
Open the Passphrase Generator and the defaults are already sensible: six words from the EFF large list. Click generate and you get something like correct horse battery staple — except the words are genuinely random, not a comic reference that every cracking dictionary includes.
Read the phrase once, then once more, and notice the small story your mind builds between the words. That story is your retention mechanism. If nothing clicks, regenerate; a phrase that resists imagery is a phrase you will forget.
Customizing Separators and Case
The generator lets you tune the output without breaking the entropy math. Separators between words — spaces, dashes, dots, or nothing at all — do not change how many combinations exist, but they change how a passphrase reads and how sites validate it. Some password forms reject spaces; a dash-separated phrase sidesteps that.
Capitalization and appended digits are similar. Forcing the first letter of each word to uppercase adds a few bits and satisfies password rules that demand mixed case. Appending a digit or symbol at the end adds entropy cheaply, though the words themselves are doing the heavy lifting. The tool applies these transformations consistently, so what you see is exactly what you should type — no surprises about which character got capitalized.
When a Passphrase Is Not the Right Tool
Passphrases are for things a human must type from memory: your master password, your laptop login, the key to your password manager. They are not for API keys, database credentials, or anything a machine stores — those should be long random strings from a Password Generator, unique per service, stored in a manager.
Length rules also matter. A passphrase truncated by a site's 16-character limit collapses to two or three words, and three-word phrases are within cracking range. If a form caps your input, switch strategies rather than accepting a weakened phrase. And whatever you end up with, run it through a Password Strength Checker to see the entropy estimate with your own eyes instead of trusting vibes.
Why Generation Happens in Your Browser
A passphrase is a secret the moment it exists, and secrets should not travel. The generator runs entirely client-side: the word list loads with the page, the random draw happens in your browser's crypto API, and the phrase never touches a server, a log, or an analytics pipeline. You can verify this the boring way — disconnect from the internet after the page loads and the generator still works — and the boring verification is the best kind.
The Takeaway
Memorable and strong stopped being a tradeoff the moment word lists were measured properly. Six or seven random EFF words beat almost everything humans invent on their own, and the phrase stays with you because your memory is built for stories, not character soup. Generate in the browser, customize separators to satisfy picky forms, keep machine credentials in a password manager where they belong, and let the dice math do the security work.
