Tool
What the Passphrase Generator does
Passphrase Generator: generates Passphrase from Number of words and Separator. Example: number of words 5 and separator Hyphen gives passphrase teen-holy-tiny-wash-base.
Point it at Number of words and Separator and it returns Passphrase. Enter what you need and trigger it when you are ready.
Typical users are people rotating an API key. Randomness quality matters here in a way it does not for most tools.
This runs client-side, which means we never receive what you enter and could not retrieve it if asked.
The sections that follow cover the fields, the method, and one full example computed from the defaults.
What do the Passphrase Generator fields mean?
The Passphrase Generator uses 2 inputs. Each input has a default that makes sense on its own, so a partial edit still gives a valid result.
| Field | What to enter | Default |
|---|---|---|
| Number of words | accepts 3 to 12 | 5 |
| Separator | choose from Hyphen, Dot or Space | Hyphen |
How does the Passphrase Generator work?
Each output is derived from the inputs above in a single pass; there is no hidden state carried between runs, so the same inputs always give the same generated output.
Values are checked first: an out-of-range or non-numeric entry names the offending field instead of returning nonsense.
Worked example
These are the values the Passphrase Generator loads by default, and the result it produces from them. Here is the calculation as it stands the moment the page loads.
| Number of words | 5 |
|---|---|
| Separator | Hyphen |
| Passphrase | teen-holy-tiny-wash-base |
|---|
Why word count matters more than list size, up to a point
This tool draws each word uniformly at random from a built-in list of 684 words, giving log₂(684) ≈ 9.4 bits of entropy per word. Lower than a full Diceware list (7,776 words, 12.9 bits/word), so reaching the same total strength takes more words here than it would with Diceware.
| 3 words (minimum) | ~28 bits | Too short for anything beyond a throwaway account |
|---|---|---|
| 5 words (default) | ~47 bits | Roughly comparable to a 4-word Diceware phrase |
| 7 words | ~66 bits | Solid for most everyday account passwords |
| 12 words (maximum) | ~113 bits | Beyond any realistic offline attack |
Worth knowing
- The entropy calculation assumes every word is chosen independently and uniformly, which holds here because the words come from crypto.getRandomValues. It would not hold for a phrase you composed yourself, since human word choice is never uniform over a dictionary.
- A shorter word list makes each word quicker to type and recognise, at the cost of needing more words for the same total entropy, five words here and four words from a 7,776-word Diceware list land in a similar range for exactly that reason.
- Separator choice (hyphen, dot, space) has no effect on entropy. It only changes readability and whether a field accepts spaces at all.
- A passphrase is meant to be memorised and typed by a person, unlike the fully random password generator above. Pick whichever generator matches how the credential will actually be used.
Read next: What Actually Makes a Password Strong
How to use it
- Enter Number of words (3 to 12).
- Pick a value for Separator: the options are Hyphen, Dot or Space.
- Press Generate passphrase.
- You get Passphrase back.
- Copy Link is the quickest way to send the exact scenario to someone else.
What this tool does not do
- Randomness comes from your browser cryptographic source, which is suitable for real secrets.
- Randomness comes from your browser's cryptographic random source, which is suitable for passwords and keys.
- It does not account for anything you did not enter, by definition.
- Results are only as good as the inputs. Check your units before reading anything into the output.
Frequently asked questions
You need Number of words and Separator. Nothing starts empty, which means a single edit is enough to get a meaningful answer.
Number of words accepts 3 to 12. Out-of-range entries are refused up front, which is safer than silently clamping them.
With the values loaded when the page opens, passphrase comes out as teen-holy-tiny-wash-base. Any edit re-runs the calculation, so there is no stale number on screen.
No. The value is created locally from your browser cryptographic random source and is never sent to us.
Nothing at all. There is no registration, no paywall and no per-use quota.
The generated output is exact for the method described above. Where a value is rounded for display, the underlying figure keeps full precision.