Passphrase Generator (XKCD)

Build random word passphrases locally with your browser’s cryptographic random source. Choose word count, separators, and an optional digit.

Loading Tool Editor...

What This Tool Generates

Generate passphrases from independently selected random words, inspired by the XKCD approach. Words can make a password easier to type and remember.

Use this tool when you need a password you can enter manually, such as a device login or vault password. Choose a word count and formatting that the destination accepts.

How To Use It Well

Increase Phrase Length to select more random words and expand the search space. The phrase regenerates as you change the settings; use Copy Phrase when you are ready.

Use a space or punctuation separator to keep word boundaries clear. Fixed separators and Capitalize First Letters change the formatting, while Digit separators and Include Number add random digits.

How-to

How to Create a Memorable Passphrase

Create a memorable passphrase from random words, generated locally in your browser. Learn how word count, capitalization, and separators affect strength.

Read guide

How-to

Passphrase vs Password: Which Should You Use?

Compare passphrases and passwords by entropy, memorability, and where each fits. Decide based on how the credential will be stored and typed.

Read guide

How-to

How to Create a Strong Password

Learn what actually makes a password strong—length, randomness, and uniqueness—and generate one locally with the LeetTools Password Generator.

Read guide

How-to

How to Choose a Username That Doesn't Link Your Accounts

Choose a username that keeps your accounts separate. Learn how names, birth years, and repeated handles reveal identity, and generate random ones locally.

Read guide

Why Use a Random Passphrase?

How Words Are Selected

A quotation or a phrase you invent can follow patterns that attackers try early. This tool uses crypto.getRandomValues to select each word independently from its word list; repeated words are possible. If secure randomness is unavailable or fails, generation stops with an error. Do not use published example passphrases as actual passwords.

What Determines the Search Space?

For independently selected words with clear boundaries, the number of possible phrases is the word-list size raised to the number of words. More random words increase that space. Printed character count alone cannot tell you whether a passphrase is harder to guess than a random-character password.

What Does the Entropy Estimate Mean?

The displayed estimate counts the random word and digit selections. It assumes an attacker knows the word list and settings. Joining words without clear boundaries can make different selections produce the same text, so use a space or punctuation separator to avoid that ambiguity. The estimate is not a prediction of cracking time or a guarantee of account security.

Passphrase Best Practices

What Fixed Formatting Changes

A fixed separator such as "-" or "#" can improve readability or meet a service's formatting rules. It adds no random entropy and does not prevent dictionary attacks on word combinations. Capitalize First Letters also follows a fixed rule, so it adds no random entropy.

When Digits Add Randomness

The Digit separator selects an independent random digit from 0 to 9 for each gap between words. Include Number appends one independently selected random digit. Each such digit adds about 3.32 bits to the estimate; typing a fixed digit into the custom separator field does not.

One Phrase, One Account

Generate a different passphrase for each account. Reusing a phrase lets someone who obtains it try the same credential elsewhere. Avoid replacing the generated words with a familiar sentence, which would no longer follow the random-selection model used by the estimate.

Passphrase Generator (XKCD)

What This Tool Generates

How To Use It Well

Guides for Passphrase Generator (XKCD)

How to Create a Memorable Passphrase

Passphrase vs Password: Which Should You Use?

How to Create a Strong Password

How to Choose a Username That Doesn't Link Your Accounts