Create a strong, memorable passphrase from securely selected random words. Nothing leaves your browser.
Word-selection entropy: 77.5 bits · 7,776 words in this list
Uses your browser’s cryptographically secure random-number generator and unbiased word selection.
Generated passphrases are never uploaded, stored, logged, or added to the URL.
SecretPost cannot recover a generated passphrase. Save it somewhere appropriate before leaving this page.
Random-word password security
A passphrase is a password made from several words chosen at random. The words make it easier to remember and type, while the large number of possible combinations makes a properly generated passphrase difficult to guess.
SecretPost selects every word locally in your browser. The generator does not use an account or server, and it never sees, stores, or transmits the passphrases shown to you.
A passphrase is a longer credential built from multiple words instead of a short string of characters. A secure passphrase is not a quotation, lyric, personal sentence, or group of words you chose yourself. Its words must be selected independently and randomly from a sufficiently large list.
Random selection matters because people naturally choose predictable words and patterns. An attacker can test those patterns long before trying every random combination.
A passphrase is still a type of password. Its advantage is usability: several unrelated words can be longer and easier to enter correctly than a shorter sequence of mixed characters. Length alone is not enough, however—the words must come from a secure random process.
Some websites impose character rules. The optional number and symbol controls can help satisfy those rules, but the conservative strength estimate on this page counts only the random word choices.
A generated result may look like meadow-lantern-orbit-copper-river-skillet. That is an illustration only: never use an example printed in explanatory text, because it is public and therefore predictable.
Generate your own private result above. Repeated words are valid because every selection is independent; regenerate if you prefer a different combination.
The generator uses the browser Web Crypto API rather than Math.random(). Each word is selected uniformly from a 7,776-word list using rejection sampling, which avoids the small bias introduced by naïve modulo selection.
With a 7,776-word list, each random word contributes about 12.9 bits of word-selection entropy. Six words provide about 77.5 bits before any optional number or symbol is considered.
Six words is the default and the safest general recommendation for this list. Four or five words may be convenient in lower-risk situations, while additional words increase protection for important encryption keys, password-manager vaults, and other credentials that may face offline guessing.
The right choice depends on the system protecting the credential and the consequences of compromise. More words improve strength but also increase typing and memorization effort.
The phrase commonly describes passwords made from several unrelated words, popularized by an XKCD comic about password strength. The memorable idea is useful, but security comes from genuinely random selection—not from inventing a clever sentence yourself.
SecretPost is not affiliated with XKCD and does not reproduce the comic. This tool implements the general random-word approach using an independently sourced wordlist.
Do not reuse the same passphrase for multiple accounts or encryption tasks. If one service is compromised, reuse lets an attacker try the exposed credential elsewhere.
A passphrase can be suitable for a password-manager master password, device encryption, an encrypted file, or a private key. It is not a cryptocurrency recovery phrase, wallet seed, or BIP39 generator.
Passphrase generator FAQ
No. Word selection and formatting happen entirely in your browser. Generated values are not uploaded, stored, logged, or included in the page URL.
The generator uses crypto.getRandomValues() and unbiased rejection sampling. It never uses Math.random() to select words, numbers, or symbols.
The EFF list contains 7,776 unique words. Six independent selections provide approximately 77.5 bits of word-selection entropy, a conservative general default recommended for a list of this size.
The generator uses a pinned copy of the 7,776-word EFF Long Wordlist, bundled with SecretPost and loaded locally in your browser.
A securely selected number or symbol adds possibilities and may satisfy a website’s rules. SecretPost’s displayed estimate deliberately counts only the random words so it does not overstate strength.
No. Nothing is saved, and there is no recovery mechanism. Copy and store the result appropriately before closing or refreshing the page.
No. This tool does not implement BIP39 or any cryptocurrency recovery standard. Never substitute a general passphrase generator for wallet software’s official recovery process.
Use each passphrase for one purpose only. Reusing it across accounts or encryption tasks increases the damage if any one system exposes it.
The 7,776-word English list is bundled with SecretPost and loaded locally. Its pinned source and license are documented, and the generator makes no third-party request.
Use your new passphrase to protect text locally, or choose a one-time secret when the recipient should open a message only once.