Generate memorable passphrases that are strong because they are long.
Four words
The practical sweet spot
4Six words
For a master password
6Three words plus extras
Where a form demands a digit
3Four is a sensible default. Six is appropriate for a password manager master password, where you type it often and it protects everything else.
Hyphens, dots or spaces. Whichever you choose, keep it consistent — the separator is part of what you have to remember.
Passphrases stick because they form an image. Say it once, then store it in a password manager as a backstop.
Four random words from a 250-word list is roughly 32 bits; six words is nearer 48. Add capitalisation and a digit and you have something strong that you can still type from memory.
Strength is calculated from the number of words drawn at random, not from character count. A long phrase you chose yourself is far weaker than a short one chosen by a machine.
Lowercase words with a simple separator are quick on a phone keyboard and on a games console, where symbol-heavy passwords are painful.
A passphrase made of several random words is easier to remember than a string of symbols and, at four or five words, considerably harder to guess. This generator draws words at random from a curated list of short, common, unambiguous words, so the result is something you can actually recall and type on a phone keyboard. Choose the number of words, the separator, capitalisation, and whether to append a number or symbol for systems that demand them. The strength figure is calculated honestly — from the number of words drawn, not the length of the resulting string.
Keep going
Related pages in Security & Privacy, plus what others are using right now.
More security & privacy that pair well with this one.
Create strong random passwords with full control over length and characters.
Test how strong a password really is, and see exactly what weakens it.
Generate secure random strings, passwords and API keys with entropy shown.
Pick a random winner from a list, or shuffle the whole list fairly.
Check a downloaded file against its published checksum, without uploading anything.
Decode JSON Web Tokens and read the header, claims and expiry.
Format, validate and minify JSON, with errors that point to the exact line.
Work out any percentage — of a number, as a share, or as a change.
Count words, characters, sentences and paragraphs as you type.
Convert between length, weight, temperature, volume, speed, data and more.
Count characters with and without spaces, against the limits that matter.
Find the mean, median, mode and range of a list of numbers, with the working shown.
Sample and population standard deviation and variance, both shown, with the working.
Turn a logo into favicon.ico, the PNG sizes a site needs, and the HTML to declare them.
Stamp text like DRAFT or CONFIDENTIAL across a PDF, in your browser.
Turn JSON into readable YAML, with quoting and multiline strings handled properly.
Escape text for HTML, or turn entities back into readable characters.
Explain a cron expression in plain English and see exactly when it will next run.