How to generate a passphrase
- Choose how many words you want. Five is a strong default; use six or more for a password manager's master password or disk encryption.
- Pick a separator (hyphen, space, dot, underscore or none), and optionally capitalise the words or add a number if a site insists on them.
- Press ↻ until you get one you like the look of, then copy it. Each one is drawn fresh with the browser's secure random generator.
Why passphrases work
A passphrase is a password made of several random words, like "orbit-candle-tunnel-velvet-harbour". It is popularised by the Diceware method and the famous xkcd "correct horse battery staple" comic. The strength comes from the size of the word list and the number of words: this generator chooses from about 24,000 common English words, so each word adds about 14.5 bits of entropy and five words give roughly 73 bits. That is comparable to an 11 or 12 character random password, but far easier to remember and to type on a phone keyboard or TV remote.
The key word is random. Phrases you make up yourself, song lyrics and quotes are much weaker, because attackers use word lists and known phrases. Never reuse a passphrase across sites; store the rest of your passwords in a password manager and keep a memorable passphrase only for the few things you must type from memory, such as the manager itself, your computer login or a Wi-Fi network. Everything happens in your browser and nothing is sent or saved.
FAQ
How many words should a passphrase have?
Five words for most uses, six or seven for a master password or encryption key.
Are spaces allowed in passwords?
Most modern sites accept spaces. If not, use a hyphen or dot as the separator.
Is a passphrase better than a random password?
Equally strong when long enough, and much easier to remember and type.