Passphrase Generator
Passphrase Generator joins 4–12 independently selected words from a built-in list of 24 words using a chosen separator. Selection uses browser cryptographic randomness, but the intentionally small dictionary caps the theoretical search space. Treat the output as a memorable demonstration or low-stakes starting point, not a guarantee for high-value authentication.
Runs locally — files stay on your deviceIs a five-word result from this generator equivalent to any five-word Diceware phrase?
No. Entropy depends on the dictionary size and sampling method; this generator uses only 24 possible words.
Passphrase search space depends on word count and dictionary size
With W equally likely words and n independent selections, the idealized search space is W^n and theoretical entropy is n × log2(W). Human-edited phrases or biased selection reduce that model.
How it works
Select a word count and separator. The browser samples an index for each position from a 24-word built-in list and joins the words; counts are clamped from four to twelve.
Key concepts
Dictionary size is critical
A small list makes every position easier to enumerate than a large audited list.
Separators add little when fixed
A known separator improves readability but does not materially enlarge the word-choice space.
When to use it
- Generate a locally produced memorable phrase.
- Demonstrate how word count affects search space.
- Create a starting phrase for a low-risk context after reviewing policy.
When not to use it
- Do not equate this 24-word list with large-dictionary passphrase systems.
- Do not use an edited predictable phrase as if it retained random strength.
- Do not reuse the output across accounts.
Worked examples
Five words
- Input
5 words joined by -- Expected output
Five random built-in words
The idealized space is 24^5, before any later human edits.
Maximum setting
- Input
12 words- Expected output
Twelve selections
The implementation caps the count at twelve.
Custom separator
- Input
Separator: space- Expected output
Words separated by spaces
The separator changes presentation.
Common mistakes
Assuming every word list is equivalent
A 24-word dictionary is far smaller than established large lists. Correction: Use a reputable password manager or audited large-list method for important secrets.
Replacing words with obvious personal details
Predictable edits undermine random selection. Correction: Keep randomly selected components intact.
Sharing a memorable phrase
Memorability does not make disclosure harmless. Correction: Treat it as a credential.
Best practices
- Use a larger audited generator for high-value accounts.
- Keep each phrase unique.
- Store recovery information securely and enable MFA.
Related operations and differences
Basic Auth Header Generator
Choose Basic Auth Header Generator when you need to generate a Basic Authorization header locally.; use Passphrase Generator specifically for passphrase.
HMAC Generator
Choose HMAC Generator when you need to create an HMAC using the browser Web Crypto API.; use Passphrase Generator specifically for passphrase.
JWT Expiration Checker
Choose JWT Expiration Checker when you need to inspect the exp claim in a JWT.; use Passphrase Generator specifically for passphrase.
JWT Header Viewer
Choose JWT Header Viewer when you need to decode a JWT header without verifying its signature.; use Passphrase Generator specifically for passphrase.
JWT Payload Viewer
Choose JWT Payload Viewer when you need to decode a JWT payload without verifying its signature.; use Passphrase Generator specifically for passphrase.
Password Entropy Calculator
Choose Password Entropy Calculator when you need to calculate estimated entropy from an assumed character pool.; use Passphrase Generator specifically for passphrase.
Limitations and privacy
- Only 24 built-in words.
- No breach or service-policy check.
- No storage, synchronization, or recovery support.
The entered value is processed locally in this browser. Avoid using an untrusted device for real credentials or secrets.
Frequently asked questions
How many words are available?
The built-in list contains 24.
Are selections cryptographically random?
They use crypto.getRandomValues.
Does a separator add meaningful entropy?
Not when it is fixed and known.
Is this suitable for every high-value account?
No.