How this generator works
Each word is one of the 7,776 words on the EFF large wordlist, chosen independently and uniformly at random. “Uniformly” is the part that matters: the browser's crypto.getRandomValues supplies random 32-bit numbers, and the generator uses rejection sampling to turn them into a choice between 7,776 words with no word even slightly more likely than another. The methodology page publishes chi-square tests over 7,776,000 word picks.
Because every word is equally likely, the strength can be computed exactly instead of estimated: log2(7,776) = 12.925 bits per word. An attacker who knows you used this list, this many words and these settings still has to search the whole space. That is the point of a passphrase: its security does not depend on the method being secret.
What the options do to the strength
| Option | Effect on entropy | Why |
|---|---|---|
| Words | +12.9 bits per word | Each word multiplies the possibilities by 7,776. |
| Separator | +0 | It is the same between every word, so an attacker tries the few common choices. |
| Capitalize Each Word | +0 | Fixed rule: nothing for an attacker to guess. Useful where a site insists on capitals. |
| One word in CAPITALS | +log2(words): 2.6 bits for 6 words | Which word is capitalized is a random choice. |
| Random capitals per word | +1 bit per word | Each word is capitalized or not, at random. |
| Add a digit | +3.3 + log2(words) bits | A random digit (1 of 10) on a random word. |
| Add a symbol | +3 + log2(words) bits | A random symbol from !#$%&*?@ (1 of 8) on a random word. |
The extras are there for sites with composition rules. An extra word adds more than any of them: 12.9 bits against at most 6 for a digit on one of six words.
How many words?
| Words | Bits | Possible phrases | Slow hash, 104/s | Fast hash, 1011/s |
|---|---|---|---|---|
| 3 | 38.8 | 4.7 × 1011 | 272 days | 2.4 seconds |
| 4 | 51.7 | 3.66 × 1015 | 5.8 thousand years | 5.1 hours |
| 5 | 64.6 | 2.84 × 1019 | 45 million years | 4.5 years |
| 6 | 77.5 | 2.21 × 1023 | 350 billion years | 35 thousand years |
| 7 | 90.5 | 1.72 × 1027 | about 1015 years | 272 million years |
| 8 | 103.4 | 1.34 × 1031 | about 1019 years | 2.1 trillion years |
| 9 | 116.3 | 1.04 × 1035 | about 1023 years | about 1016 years |
| 10 | 129.2 | 8.08 × 1038 | about 1027 years | about 1020 years |
The EFF recommends six words for most uses. Four or five can be enough where a service limits guessing (a login that throttles attempts), and more makes sense for a secret that protects other secrets, such as a password manager's master password. See how many words a passphrase needs for the reasoning.
Is the count exact even with no separator? Yes. The EFF list is prefix-free: no word is the beginning of another, so a run of words joined together splits back into exactly one sequence. Its four hyphenated words (drop-down, felt-tip, t-shirt, yo-yo) cannot be confused with two separate words either, because “drop”, “felt”, “t” and “yo” are not on the list. The build checks this.