Free privacy tool
Passphrase generator
Four dice-picked words beat clever letter swaps, and you can check that claim right here. The words come from the EFF large wordlist, served from this site. Each word is drawn with your browser’s cryptographic random generator, or from your own physical dice if you prefer. The entropy math is on the table below. Nothing is sent and nothing is stored. Generate until you find one you can remember.
Generated in your browser. Nothing sent, nothing stored.
…
Copying puts it on your clipboard. Paste it where it belongs, then copy something else. Clipboard managers and Universal Clipboard can keep or sync what you copy.
The wordlist failed to load. Reload the page to try again. Nothing can be generated without it.
Roll five real dice per word, or one die five times. The same rolls always give the same words. The randomness is yours, made of plastic, and this page becomes a lookup table.
Tap each roll as you make it, or type the digits instead.
Nothing here to trust: the page contributes no randomness in this mode. Check any word by hand in the raw wordlist file.
The entropy math below assumes fair dice and honest throws. With real dice, that part is yours to guarantee, not ours.
Separators and capitalization are fixed patterns an attacker is assumed to know, so they add +0 bits. Pick them for easy typing, not strength.
The digit is drawn randomly and adds +3.3 bits. Real, but only about a quarter of one extra word.
The “append a digit” option is off here: it would come from the browser’s randomness, which dice mode exists to avoid. Add your own digit after copying if a site demands one.
Any change draws a fresh passphrase. Options never rework the one on screen.
In dice mode your rolls fix the words. Separator and capitalization restyle the same phrase instead of drawing a new one.
The math, on the table
log₂(7,776) = 12.925 bits per word · median crack time = combinations ÷ 2 ÷ guess rate
Same illustrative rates and the same median formula as the PIN crack-time calculator. The two pages are meant to be read side by side.How long would your PIN survive? Compare →
The count assumes the attacker knows the whole scheme (the wordlist, the separator, the pattern) and lacks only your words. That is the standard, honest way to measure.
These times assume the passphrase is randomly generated (that is what this page is for) and not reused anywhere that leaked.
Where the randomness comes from
In browser mode, words are drawn with crypto.getRandomValues, the operating system’s cryptographic random generator and the same source password managers rely on. Rejection sampling removes modulo bias. We deliberately did not add a “tap some squares for extra entropy” step. Human taps are biased and worth a few bits at best. Bolting them onto a CSPRNG would imply the CSPRNG needs help. It does not, and theater is not security.
If you would rather not trust this page’s randomness at all, that is what dice mode is for: you roll, the page looks up, and the lookup is checkable by hand. That is the original diceware ritual, and the reason the wordlist ships with dice codes in its first column.
Honest FAQ
Why do four random words beat “P@ssw0rd!”?
Crackers don’t attack letters, they attack patterns. “P@ssw0rd!” is a dictionary word with the exact substitutions every cracking tool tries first. Its real strength is a small fraction of what it looks like. Four dice-picked words carry 51.7 bits of genuine randomness: about 3.7 quadrillion equally likely possibilities. No wordlist-plus-rules run can shortcut that. Randomness beats cleverness, and more words is what scales it.
Is it safe to generate a passphrase in a browser tab?
This page draws its randomness from crypto.getRandomValues, reads a wordlist served from this site, and makes no network requests when generating. You can verify that in DevTools. The honest caveats live outside the math. The phrase exists in this tab’s memory, and on your clipboard once you copy it. Generate as many as you like. Treat the one you keep like the secret it just became.
What is the wordlist, exactly?
The EFF large wordlist: 7,776 words chosen for memorability and distinct prefixes. 7,776 = 6⁵, so each word equals one throw of five dice. Picking with a CSPRNG is the digital version of the same ritual. The copy on this site is byte-identical to EFF’s original (SHA-256 beginning addd3553…, provenance published alongside the file). No CDN is involved.
Do the options make it stronger?
Mostly no, and the labels say so. Separators and capitalization are fixed patterns, worth +0 bits against an attacker who knows the scheme. The appended digit is drawn randomly and adds +3.3 bits: real but small. The only knob that scales is the word count. Every added word multiplies the possibilities by 7,776.
What if I don’t trust this page’s randomness?
Then don’t use it. Switch to dice mode and bring your own. Five throws of a real die pick each word. The page just looks the code up in the public wordlist file, which you can do by hand to check it. A lookup table has nothing to be “guessable” about. Browser mode stays the convenient path: crypto.getRandomValues is the operating system’s CSPRNG, the same source password managers rely on.
The wordlist, verifiable
This site serves the EFF large wordlist byte-identical to the original (SHA-256 addd35536511597a02fa0a9ff1e5284677b8883b83e986e43f15a3db996b903e), verified against two independent package mirrors and a publicly recorded checksum. The file and its provenance note are open:
How this works
Each word is chosen by rejection sampling on 32-bit values from crypto.getRandomValues (no modulo bias) against the 7,776-entry list. The optional digit is drawn the same way. In dice mode your own throws replace the sampling entirely. Each five-digit group addresses one word in the file’s dice-code column, and the page adds no randomness of its own. Generation happens entirely in this tab: zero requests at generation time, nothing saved anywhere. Crack times are medians (half the keyspace) at the stated illustrative rates.
Words this strong deserve a door this solid.
Sealby locks each vault with your PIN or passphrase run through Argon2id calibrated on your device. The slow lane above is the one an attacker actually faces. Your photos, behind your words.
iPhone & iPad · iOS 17+ · Free