Random words beat clever passwords: what Diceware is, why the EFF's 7776-word list can be public without weakening anything, how many words you actually need in 2026, and how to verify this generator against a handful of physical dice.
What Diceware actually is
Diceware is the 1995 idea of turning dice into passwords: roll five dice, read them as a number like 25143, look that number up in a list of 7776 words (6⁵, one word per possible roll), repeat. Because every word is chosen uniformly from 7776 candidates, each contributes exactly log2(7776) ≈ 12.9 bits of entropy, and the arithmetic is unarguable in a way no password-strength meter is.
This page automates the rolls with crypto.getRandomValues against the EFF large wordlist, which replaced the original list's cryptic fragments with real English words of three to nine letters. The list ships inside the page, generation is local, and the tab keeps working offline, which you can verify and should.
How to use this generator
Set the word count, pick a separator, click a passphrase to copy it. The entropy readout and both crack-time estimates update live, computed the same way as on our password generator: average guesses at a stated rate, not a colored bar.
- --capitalize upper-cases every word for the forms that demand it. It is a fixed pattern, so the entropy stat deliberately does not move; honesty over flattery.
- --add-digit inserts one random digit as its own segment at a random position. Value and position are both drawn randomly, so it is worth log2(10 × positions), about 6 bits at six words, and the stat does move.
- --show-rolls prints the five-dice sequence for every word, which turns this page into something rare for a generator: auditable. Roll physical dice, look the numbers up, compare.
Four entries on the EFF list contain a hyphen (drop-down, felt-tip, t-shirt, yo-yo). With the default hyphen separator one of them can look like two short words; it is still one list entry and the entropy math is unaffected.
How many words you need
| Words | Entropy | GPU rig, fast hash (10^12/s) | Verdict |
|---|---|---|---|
| 4 | 51.7 bits | about 30 minutes | too little for anything that matters |
| 5 | 64.6 bits | about 5 months | fine behind a slow hash (Argon2, bcrypt) |
| 6 | 77.5 bits | about 3,400 years | the default; right for master passwords |
| 7 | 90.5 bits | about 28 million years | long-term secrets |
| 8 | 103.4 bits | about 2 × 10^11 years | wallet seeds, paranoia budget |
The fast-hash column is the worst case, a leaked database hashed with something never meant for passwords. The secrets a passphrase typically protects sit behind deliberately slow verifiers: against a password manager vault an attacker manages thousands of guesses per second, not a trillion, which stretches the five-word row from 5 months to some 44 million years. We default to six because the sixth word costs two seconds of typing and buys a factor of 7776 across every scenario at once.
Why a public wordlist is fine
Every question about passphrase security eventually lands here: the attacker has the list, knows you used six words, knows the separator. Fine. That knowledge is the starting assumption of the entropy math, not a hole in it; 7776⁶ is 2.2 × 10²³ regardless of who reads the list. Secrecy of the method is worth nothing, randomness of the selection is worth everything, which is Kerckhoffs's principle wearing a password hat.
The corollary cuts the other way: a passphrase you composed yourself gets none of this math. Human-invented phrases come from language, and cracking tools search song lyrics, quotes and grammatical templates long before they brute-force word combinations. The whole value of the dice, physical or simulated, is that no part of the result passed through your taste.
Doing it with physical dice
For a secret that outranks your trust in any software, including this page: five ordinary dice, one throw per word, read left to right, look up the number, write the word down. Six throws later you have a passphrase whose randomness you personally witnessed. No casino-grade dice required; the bias of a normal die is measured in fractions of a percent and irrelevant at these scales.
The --show-rolls flag exists to bridge the two worlds. It prints the roll sequence for every generated word, so you can take any line this page produces and confirm against the published list that the mapping is real, or reproduce a passphrase from rolls alone. A generator you can audit with dice from a board game is our idea of transparency.
Where passphrases beat random strings
A passphrase is not a general replacement for random passwords; it is the right tool for the small set of secrets a human must remember and type. Master password of the password manager. Full-disk encryption. The computer login. A WiFi key houseguests type from a chalkboard. Everything else, the two hundred website accounts, belongs to the manager and its 20-character random strings, which never touch a human memory.
For that split and the storage side of the story, how services should be hashing whatever you send them, see our password hashing guide. The short version: you control entropy, the service controls the hash, and a passphrase is you doing your half properly.
Passphrase questions
How many words should a passphrase have?
Six words from the EFF large wordlist, about 78 bits of entropy, is the sensible default for anything important that you type from memory: a password manager master password, disk encryption, an OS login. Five words (65 bits) are acceptable when the verifier is slow by design, like the Argon2 or bcrypt hashing a serious password manager uses. Go to seven or eight words (90 to 103 bits) for secrets that must survive decades of offline attack, cryptocurrency wallet seeds being the classic case. Below four words a passphrase stops being a security measure.
Is "correct horse battery staple" still a good passphrase?
That exact string is one of the first guesses every cracking wordlist makes, so no, never use it. The method it illustrated, from the 2011 xkcd comic 936, remains sound: four words randomly chosen from a 2048-word list carry 44 bits, which the comic correctly computed. The two things that changed since: 44 bits is marginal against a modern GPU attacking a fast hash, and people who pick the words themselves instead of rolling them get far less than 44 bits. Use six machine- or dice-chosen words and the method holds up fine.
Does adding numbers or capital letters make a passphrase stronger?
Only if their value and position are random. Capitalizing every first letter is a fixed pattern the attacker models for free, so it adds nothing beyond satisfying a composition rule; a digit appended at the end adds barely more, because that is where everyone puts it. A digit whose value and position are both random adds log2(10 × positions), about 6 bits for a six-word phrase. This generator implements exactly that with --add-digit and counts it honestly in the entropy stat, while --capitalize is deliberately counted at zero.
If the wordlist is public, can attackers not just try all the words?
They can and do, and the entropy math already assumes it. Kerckhoffs's principle: the security lives entirely in the random selection, not in the secrecy of the list. Six words from 7776 candidates are 7776^6, about 2.2 × 10^23 combinations, and knowing the list perfectly does not shrink that number. What would shrink it is choosing the words yourself, because human choices cluster around common words and meaningful phrases, which is the space cracking tools search first.
Should I put spaces between passphrase words?
Spaces are fine for security and usually fine for software; the separator carries no meaningful entropy either way, since an attacker who assumes hyphens loses nothing trying spaces next. The practical concerns are mundane: some forms trim or reject spaces, mobile keyboards autocapitalize after them, and a space typed twice is invisible. A hyphen sidesteps all three, which is why it is this generator's default; the separator field takes anything, including nothing.
How do I generate a Diceware passphrase with real dice?
Roll five ordinary dice per word (or one die five times), read them left to right as a five-digit number like 25143, and look that number up in the wordlist, which indexes every word by exactly one such roll. Repeat per word. Physical dice remove the need to trust any software randomness, including this page. Turn on --show-rolls here and the generator prints the roll sequence next to every word, so you can spot-check that the mapping matches the published EFF list.
What is the difference between the EFF wordlist and the original Diceware list?
Arnold Reinhold's 1995 list optimised for length: many entries are short fragments, abbreviations and strings like "ab" or "99", which keep passphrases short but make them hard to memorise and to say aloud. The EFF large list from 2016 has the same 7776 entries and therefore identical entropy (12.9 bits per word), but selects real, recognisable English words of 3 to 9 characters and drops the awkward fragments. Slightly longer passphrases, much easier to actually remember, which is the entire point of a passphrase.
Is a six-word passphrase stronger than a 12-character random password?
Yes, and it is not close in usability. Six EFF words are about 78 bits; a 12-character password from the full 90-character set is about 78 bits too, so the strength is a wash. The difference is that one of them is Kp3]wq@Zn7f{ and the other is six English words you can memorise in a minute and type on a phone. Per character typed the password is denser, per unit of human effort the passphrase wins, which is why passphrases are the right shape for the handful of secrets that must live in your head.