Each word drawn from the 7,776-word EFF Large Wordlist adds log2(7776) ≈ 12.9 bits, so the default six-word passphrase is one of about 2.2 × 10²³ possibilities, or 77.5 bits. That is the length EFF itself recommends for most uses. A passphrase is easier to remember and type than a random string of the same strength.
When words beat random characters
Some passwords have to live in your head. The one that unlocks your password manager, the login for your laptop, the key for an encrypted disk: you type these from memory, often several times a day, and a password manager cannot fill them for you. A string like q7#Vd!2mZ is hard to remember and easy to mistype. Six ordinary words such as pester-parameter-removed-popular-dollhouse-brick are longer, but most people can learn them in a day or two.
The trick is that the words must be picked by a random process, not by you. People choose song lyrics, quotes and familiar phrases, and password-cracking tools carry huge lists of exactly those. A word drawn uniformly from 7,776 options is a fixed 12.9 bits no matter how ordinary it looks.
US government advice agrees with the approach: CISA lists four to seven unrelated words as an acceptable alternative to a random string. Windows LAPS, Microsoft's tool for rotating local administrator passwords, can produce passphrases from word lists based on EFF's and defaults to six words.
Generate a passphrase
- Leave the word count at 6, or set any number from 3 to 12.
- Keep the hyphen separator or switch to a space, dot, underscore, or none.
- Turn on capital first letters or an added digit if a site asks for them.
- Press Generate, and press it again until you get a set you can picture.
- Store the passphrase in your password manager, or write it down and keep the paper safe until you know it by heart.
The options and what they change
| Option | Effect on entropy | Why you might use it |
|---|---|---|
| Word count (3–12) | +12.9 bits per word | The main dial for strength |
| Separator (hyphen by default) | None; you choose it | Spaces read naturally; hyphens survive forms that trim spaces |
| Capital first letters | None; every word gets one | Satisfies "needs an uppercase letter" rules |
| Add a digit | Adds log2(10 × number of words) bits, about 5.9 with six words | Satisfies "needs a number" rules |
Capitals and separators are applied to every word in the same way, so they add no unpredictability. An attacker who knows you used this tool also knows the options exist. Only the random choices count toward the figure the page shows: the words, plus, when you add one, the digit and the word it follows. The digit is one of ten values placed after one randomly chosen word, so it contributes log2(10 × words) bits, for example log2(60) ≈ 5.9 bits with six words.
The "no separator" option is safe with this list because EFF built it so that no word is the start of another word. Joined together, sizablepresume can only be split one way, so nothing is lost by dropping the separators. Four entries contain their own hyphen (drop-down, felt-tip, t-shirt, yo-yo), which can look odd with a hyphen separator but does not change the strength.
How many words?
The table assumes an attacker who knows your settings and the word list, guessing offline. Times are for searching half of all possible passphrases, which is the average. Two guess rates are shown: 10¹⁰ per second, close to a single RTX 4090 attacking unsalted SHA-256, and 10¹² per second, what four of those cards reach against NTLM. A site that stores passwords with a slow hash such as bcrypt or Argon2, or that locks accounts after repeated failures, pushes these times out by many orders of magnitude.
| Words | Bits | One GPU (10¹⁰ per second) | Four GPUs (10¹² per second) |
|---|---|---|---|
| 3 | 38.8 | 24 seconds | under a second |
| 4 | 51.7 | 2 days | 30 minutes |
| 5 | 64.6 | 45 years | 165 days |
| 6 | 77.5 | 350 thousand years | 3,503 years |
| 7 | 90.5 | 3 billion years | 27 million years |
| 8 | 103.4 | 2.1 × 10¹³ years | 212 billion years |
Six words is the sensible default for something you memorize. Use seven or eight to unlock a password vault or an encrypted drive, where an offline attack is the realistic threat. Three or four words only make sense where the system enforces attempt limits.
Length in characters
Entries in the EFF list run from 3 to 9 characters and average 7.0. A six-word passphrase with hyphens is 23 to 59 characters long, 47 in the middle of the range. That clears any minimum length, including NIST's 15-character rule for single-factor passwords. The ceiling is the thing to watch: an eight-word passphrase with separators passes 64 characters about a third of the time, and some sites stop accepting input there. NIST only asks services to permit at least 64 characters, so test long passphrases by signing out and back in.
Need a random string instead?
The second tab on this page makes a classic random password from letters, digits and symbols, with the same controls as the password generator. Use it for accounts your password manager fills in automatically. For a shorter word-based password that still passes most composition rules, see the memorable preset. If you want to pick the words with physical dice, the Diceware page shows the dice numbers for every word.
Your passphrase stays here
Words are chosen inside your browser from a copy of the list that ships with the page. Nothing you generate is uploaded, logged or saved, and the page does not remember previous results. If you close the tab before saving the passphrase, it is gone for good, so store it first.
Technical notes
The tool picks one list position per word with crypto.getRandomValues. The raw random numbers cover a range that is not a multiple of 7,776, so values in the uneven top slice are discarded and redrawn; each word keeps exactly the same 1-in-7,776 chance. The list is the unmodified EFF Large Wordlist, published by the Electronic Frontier Foundation under a Creative Commons Attribution license; see the EFF wordlist announcement and our licenses page. The methodology page shows how to confirm in your browser's developer tools that generating makes no network requests.
FAQ
Is a passphrase really as strong as a random password?
Strength depends on the number of equally likely outcomes, not on how the result looks. Six EFF words give 77.5 bits, about the same as a 12- or 13-character random password using letters, digits and symbols. Add words to go further.
Does it matter that the word list is public?
No. The calculation already assumes the attacker has the list. The protection comes from the 2.2 × 10²³ possible six-word combinations, not from secrecy about where the words came from.
Can I swap a word I do not like?
Pressing Generate again is better than editing. Hand-picking words, even one, nudges the result toward words people find pleasant, which attackers can model. Regenerate the whole passphrase until one sticks.
Should I add symbols or numbers to the words?
Only if a site requires them. Swapping letters for look-alike digits adds very little, because cracking tools try those swaps automatically. An extra word adds 12.9 bits and is easier to remember.
Why does a site say my passphrase is too long?
Some services cap password length, sometimes at 64 characters or lower. Drop to fewer words, remove the separators, or check whether the site has an alternative sign-in method.
How does this compare with the EFF's printed method?
It uses the same list and the same uniform chance per word. The difference is the source of randomness: your browser's cryptographic generator instead of physical dice. The Diceware page covers the dice route.
Sources
- EFF: new wordlists for random passphrases
- CISA: Use strong passwords
- Microsoft Learn: Windows LAPS passwords and passphrases
- NIST SP 800-63B-4
- hashcat 6.2.6 benchmark, RTX 4090
Checked 2026-10-11.
Last updated: