Generate strong, memorable passphrases from the authentic EFF wordlist (7,776 words). Every word is picked with a bias-free cryptographic RNG (rejection sampling — no modulo bias), and every passphrase shows its real entropy plus honest crack-time estimates. No signup, no server: 100% client-side.
True diceware uses real dice. Roll five dice per word (four for the short list), type the results below separated by spaces or commas — e.g. 12345 53124 66666 — and this tool maps each roll to its EFF word. Your rolls never leave the browser.
Honest numbers, same attacker model for every row (offline attack, 10 billion guesses/second — a very fast adversary). "Average crack time" = 2bits−1 ÷ guess rate.
crypto.getRandomValues), and everything runs in your browser. Verify in DevTools → Network. Nothing you generate ever leaves this device.Diceware, invented by Arnold Reinhold, turns dice rolls into passwords. Roll five dice, look up the 5-digit number (11111–66666) in a 7,776-word list, write down the word. Repeat. Because each of the 7,776 words is equally likely, the security is exactly calculable: one word = log2(7776) ≈ 12.9 bits of entropy, six words ≈ 77.5 bits. No cleverness, no patterns for attackers to exploit — just arithmetic.
This generator automates the dice with your device's cryptographic random number generator and uses the modern EFF wordlist (2016), which replaced the original 1995 list's obscure words ("cleft", "ibex") with short, memorable, unambiguous ones. A second, shorter EFF list (1,296 words, 4 dice per word) is available for faster typing at slightly lower entropy per word (≈10.3 bits).
Most "password strength meters" show a reassuring green bar backed by nothing. Entropy here follows Kerckhoffs's principle — assume the attacker knows your method:
Every passphrase above shows this exact breakdown, plus average crack times under three attacker models — a rate-limited online login, an offline attack against a slow KDF (bcrypt/Argon2), and an offline attack against a fast hash (SHA-256).
The famous XKCD #936 comic made the case: a human-mangled password like Tr0ub4dor&3 looks strong but has only ~28 bits of real entropy — attackers guess common mangling patterns. correct horse battery staple (4 words, ~52 bits) is both stronger and easier to remember and type. The lesson: length from randomness beats complexity from cleverness. Diceware is that lesson turned into a procedure.
Tools like Bitwarden, 1Password, LastPass, Proton Pass, Dashlane, Keeper, and KeePass all include excellent random-character generators — perfect for the hundreds of logins stored in your vault that you never type. Diceware wins for the handful of secrets you memorize and type: your vault's master password, full-disk encryption, your WiFi, an SSH key passphrase. A memorable 6-word phrase you can type without errors beats a 20-character soup you have to copy-paste.
| This tool | Bitwarden / 1Password generator | Generic web diceware pages | |
|---|---|---|---|
| Wordlist | Authentic EFF large + short, embedded & verified (7,776 / 1,296 words) | Wordlist-based "passphrase" mode (smaller lists) | Varies; often unverified |
| Randomness | CSPRNG with rejection sampling (documented, tested) | CSPRNG | Often Math.random() — not cryptographic |
| Entropy display | Real per-option math + crack times | Bits shown (Bitwarden) | Rarely |
| Physical-dice mode | Yes — paste real rolls | No | Rarely |
| Network requests | Zero | Local app | Varies |
Feature sets change over time — compare current versions before choosing. Table accurate as of October 2026.
Different tools for different jobs. A passphrase generator (this page) emits memorable word sequences for secrets you type. A password generator emits random characters (xQ9#mZ2$vLqW7!) for secrets a manager stores. Neither is "better" — use passphrases for master passwords and encryption keys, random characters for everything else. And neither relates to password hashing (bcrypt/Argon2), which is what developers use to store passwords server-side — a separate concern with separate tools.
ssh-keygen -p.Prefer not to trust any RNG, even your device's? Roll five real dice per word (four for the short list), enter the numbers in the Physical Dice Mode tab, and the tool maps each roll to its EFF word — the page only does the lookup, the randomness is 100% yours. This is also the recommended way to generate a master password on an air-gapped machine.
A diceware passphrase is a password made of several random common words, e.g. "correct horse battery staple". The diceware method (by Arnold Reinhold) picks each word by rolling dice and looking the number up in a wordlist — five dice per word for the 7,776-word EFF list. Because every word is chosen uniformly at random, the security is exactly calculable: each word contributes log2(7776) ≈ 12.9 bits of entropy.
Four words (≈52 bits) is the minimum for anything important; five words (≈65 bits) is a good default; six words (≈78 bits, the famous XKCD example) is strong; seven words (≈91 bits) is very strong. Three words (≈39 bits) is NOT enough for valuable accounts — it falls to a fast offline attack in hours. Use the generator above and check the entropy badge on every passphrase.
Yes — diceware's security is pure mathematics, not obscurity. A 6-word EFF passphrase has ~77.5 bits of entropy regardless of the year; what changes is attacker hardware speed, which is why the crack-time estimates above assume a very fast offline attacker (10 billion guesses/second). Against a rate-limited online login, even 4 words is effectively uncrackable. The method does not age as long as words are picked truly at random.
They solve different problems. Password-manager generators (Bitwarden, 1Password, Proton Pass) excel at random character passwords you never type — ideal for the 200 logins in your vault. Diceware excels at the few passwords you must MEMORIZE and TYPE: your master password, disk encryption, WiFi. A 6-word diceware phrase (≈78 bits) matches a 12-character random password in strength but is far easier to remember and type correctly.
Entropy (in bits) measures how many guesses an attacker needs on average: 2^(bits-1). Most generators show a meaningless "strength bar". This tool computes it honestly from the generation method — words × log2(wordlist size), plus only the options that add real randomness (an appended digit adds log2(10) ≈ 3.3 bits; a fixed separator adds zero). If a tool cannot explain its entropy number, do not trust it.
A passphrase generator produces memorable sequences of real words (diceware); a password generator produces random characters like "xQ9#mZ2$vL". Use passphrases for secrets you type from memory (master passwords, encryption keys, WiFi); use random characters for everything stored in a password manager. They are complementary, not competitors — and neither is related to password hashing tools like bcrypt, which serve developers storing passwords server-side.
Yes — WPA2/WPA3 accepts any 8–63 character passphrase, and a 5–6 word diceware phrase is ideal: strong and easy to read out to guests. Note some older devices dislike spaces, so use the dash or "no spaces" separator option above if needed.
Yes. An SSH key passphrase protects your private key file if it is stolen, and a 5–6 word diceware phrase is both strong and typeable. Generate it here, then set it with "ssh-keygen -p" on your existing key or when creating a new one.
No — do not do this. Crypto wallet seed phrases use the BIP-39 standard (a specific 2048-word list plus a checksum word); a diceware phrase is not a valid BIP-39 seed and wallets will reject it. For wallet backup, always use the seed phrase your wallet itself generates. Diceware is for passwords you memorize, not for wallet seeds.
Yes. A high-entropy passphrase (6–7 diceware words, ≈78–91 bits) works fine as an HMAC signing secret for JWTs — what matters is unpredictability, not format. For machine-to-machine secrets you never type, a random 32-byte hex or base64 string is the more conventional choice, but a long diceware phrase is equally strong.
The EFF (Electronic Frontier Foundation) wordlists are the modern standard diceware lists, designed in 2016 to fix the original 1995 list's obscure words and typos. The large list has 7,776 short, memorable, distinct English words (one per 5-dice roll); the short list has 1,296 words (one per 4-dice roll). They are published under Creative Commons Attribution (CC-BY); this tool embeds them verbatim and credits the EFF.
Because the math does not work: 3 words from the EFF large list give only ≈39 bits of entropy — a fast offline attacker guessing 10 billion hashes per second cracks it in hours on average. "Three random words" advice (popularized by the UK NCSC for low-value accounts) assumes online, rate-limited logins. For anything valuable, use at least 4–5 words; the Compare tab shows exact numbers.
Only if they are chosen RANDOMLY. A fixed separator (always dashes) or fixed capitalization (always first-letter) adds zero bits — the attacker knows your method. Randomly capitalizing each word adds 1 bit per word; one appended random digit adds ≈3.3 bits; one random symbol adds ≈4.6 bits. This tool's entropy display accounts for exactly this, so you see honest numbers instead of marketing.
Only if the site is truly client-side. This generator runs entirely in your browser: the wordlist is embedded in the page, randomness comes from your device's cryptographic RNG (crypto.getRandomValues), and the page makes zero network requests — verify in DevTools. Nothing you generate ever leaves your device. Never use a generator that sends data to a server, and for the truly paranoid, the physical-dice mode lets you supply your own randomness.
The EFF publishes its wordlists in English only. Unofficial translated diceware lists exist, but mixing languages changes the entropy math (word counts differ) and translations are harder to verify. This tool ships the authentic English EFF lists (large + short) so the entropy numbers are exact. If you need a non-English list, verify its size and uniformity before trusting any entropy claim about it.
Free tool by NRTechStudio
Explore similar security tools and calculators. 100% free, accurate, and runs completely in your browser without sign-up.
2 taps, no typing needed — diagnostics are sent automatically.