Memorable Password Generator

A passphrase built from randomly chosen words is far easier to remember and type than a scramble of symbols, and just as hard to guess if you use enough of them. Each word is picked with a cryptographic random source, and the entropy is shown so you can judge the result yourself.

Last updated:

Why a passphrase instead of random characters

There are a handful of passwords you genuinely have to remember: the one that unlocks your password manager, your device login, and whatever you type on a television or games console where a manager cannot reach. For those, a random string is the wrong tool — you will either write it somewhere careless or pick something weak because the strong version is unusable.

A passphrase is several unrelated words joined by a separator. It is longer than a random password and each character carries less entropy, but that is a trade worth making, because the whole thing survives being typed from memory on a remote control.

The words are chosen with the same cryptographic randomness as the character mode. "Random-looking" words picked by a human are not random — people reach for the same nouns, and an attacker exploits that.

How much security a passphrase actually gives you

Entropy per word is log2 of the wordlist size, and nothing else. This generator draws from a 7,776-word list — the Diceware size — so every word is worth 12.9 bits.

That puts a five-word passphrase at 64.6 bits, and 68 with a digit appended — the same figure the major password managers quote for their five-word default. Six words is 77.5 bits and seven is 90.5, which is past the point an offline attack is worth anyone’s electricity.

Those times assume 100 billion guesses a second against a stolen password database — an aggressive offline attack on a fast hash. A site that rate-limits logins is thousands of times slower, so treat these as the worst case rather than the likely one.

The honest way to read any passphrase generator is to ignore the word count and look at the bit count. A five-word passphrase from a 1,000-word list and a five-word passphrase from a 7,776-word list differ by about 15 bits — a factor of thirty thousand in guessing effort — and most tools will not tell you which one you just got.

  • 4 words: 51.7 bits — about five hours of offline guessing. Fine for a throwaway login, not for anything that matters
  • 5 words: 64.6 bits — around five years. This is the default here, and the same default the big password managers ship
  • 6 words: 77.5 bits — roughly 35,000 years, and the point most people should stop
  • 7 words: 90.5 bits — for a password manager's master credential, where you type it rarely

Making a passphrase that survives real typing

Capitalising each word costs nothing in entropy — an attacker who knows the format gains nothing from it — but it makes the boundaries visible when you are reading the phrase off a screen and typing it into a television. It is on by default for that reason alone, not for security.

The trailing digit exists purely because many sites still demand a number. It adds about 3.3 bits, which is negligible; its job is to satisfy a validation rule without forcing you to mangle the phrase yourself.

Choose the separator for where you will type it. Dashes are the safe default. Spaces read most naturally but a few login forms trim or reject them. Dots and underscores survive nearly everywhere.

Where to put the password once you have it

A generated password is only useful if you can retrieve it. The honest answer for most people is a password manager — it removes the need to remember anything except one master credential, and it fills passwords only on the domain they belong to, which quietly defeats most phishing.

If you are not going to use one, write the password down and keep the paper somewhere physical and private. A note in a drawer is a better outcome than a memorable password reused across accounts, because the realistic threat to your accounts is a credential-stuffing bot working through a leaked database, not a burglar reading your desk.

  • Never reuse a password across sites — one breach then unlocks everything
  • Turn on two-factor authentication where it is offered; it protects you even if the password does leak
  • Change a password when a service discloses a breach, not on a fixed schedule — forced rotation pushes people toward predictable patterns
  • Treat security questions as passwords too, and generate answers rather than using real ones

Frequently Asked Questions

Are passphrases actually secure?

They can be, but the word count alone does not tell you. Security is the number of words multiplied by the bits each word carries, which depends entirely on how large the wordlist is. This tool uses a 7,776-word list at 12.9 bits a word, so five words is 64.6 bits. Always read the bit count rather than trusting a word count.

How many words should a passphrase have?

Five is the default here and resists an offline attack. Use seven for a password manager's master credential, where the extra typing happens rarely. Four is acceptable for a low-value account you simply need to remember.

What wordlist does this use?

A 7,776-word list, the same size Diceware and the major password managers use, so each word carries 12.9 bits. Every word is 3 to 9 lowercase letters, no word is a prefix of another, homophone pairs like plain and plane are reduced to one, and words about death, illness, violence or crime are excluded so the phrase is safe to read aloud.

Is a passphrase better than a random password?

Only where a human has to type it from memory — a device unlock, a password-manager master password, a console login. Everywhere else a password manager does the typing and a random string is denser and shorter.

Should I use words that mean something to me?

No. Names, dates and favourite things are guessable by anyone who knows you or reads your social media, and they collapse the search space enormously. The value of a generated passphrase is precisely that the words have no connection to you.

Does adding a number make it much stronger?

Barely — about 3.3 bits. The digit is there to satisfy sites that require a numeral, not to add meaningful security. Adding one more word is worth 12.9 bits, roughly four times as much.

Can I type a passphrase with spaces into any site?

Most accept spaces, but some login forms trim or reject them, and the failure is confusing because the password looks correct. Dashes are the safer default, which is why they are preselected.

Related free tools

More free utility tools