Password generator with words

Random real words joined into one password. Pick a preset or set the word count, then copy. Every word is drawn on your device.

The generator needs JavaScript: every word is picked on your device, never on a server.

How strong is a password made of words?

Each word is one random pick from the Electronic Frontier Foundation's long wordlist of 7,776 words, so every word adds log2(7,776) ≈ 12.9 bits. The attacker is assumed to know the list and your settings; the strength comes only from the random picks.

WordsEntropyPossible passwordsSuits
338.8 bits4.7 × 1011Low-value logins with 2FA
451.7 bits3.7 × 1015Everyday accounts
564.6 bits2.8 × 1019Email, banking
677.5 bits2.2 × 1023Master password, disk encryption

For guess times at different attack speeds, try the passphrase entropy calculator.

Word passwords that pass "must contain" rules

Many sign-up forms still demand an uppercase letter, a number and a symbol. Tap Site rules above: you get capitalised words plus one random digit and symbol, such as the pattern Word-Word-Word-Word7#. If a form caps the length, switch to the short wordlist or drop the separator. The memorable password generator also has an AI helper that reads a site's rules and picks settings for you.

Don't edit the words

It is tempting to swap a word you dislike for one you like. Avoid it: the words people choose are predictable, and the entropy shown assumes the tool picked every one. Press Show 5 options instead and take the one you find easiest to picture.

Other styles: xkcd-style four common words, pronounceable syllables, or real dice if you'd rather not trust any computer.

Word password questions

Is a password made of words safe?

Yes, if the words are picked at random. Four random words from the EFF's 7,776-word list give about 51.7 bits; five give 64.6; six give 77.5. A phrase you chose yourself, a song lyric or a quote is far weaker, because cracking tools try common phrases first.

How many words should a password have?

Use four words for everyday accounts protected by two-factor authentication, five for important accounts, and six or more for a password-manager master password, full-disk encryption or anything that could be attacked offline.

What about the "three random words" advice?

The UK National Cyber Security Centre recommends three random words because it is far better than the patterns people usually invent. Three EFF words are about 38.8 bits, fine behind rate-limited logins with 2FA. For anything more sensitive, add a fourth word rather than a symbol: a word adds 12.9 bits, a symbol about 3.3.

Can I add numbers and symbols to a word password?

Yes. Pick the "Site rules" preset and the generator adds a random digit and symbol and capitalises each word, which satisfies most sign-up forms. They add little strength, so treat them as a way to pass the form, not as security.

Does this tool send my password anywhere?

No. The words are picked on your device with crypto.getRandomValues, the browser's cryptographic random number generator. Nothing you generate is sent, logged or stored unless you switch on history on this device.