Passphrase generator
Random words that are easy to read aloud and hard to guess. Use one where a person has to type or say it - over the phone, on a new device, or to unlock a shared secret. Nothing you generate here is sent anywhere.
·
For password rules
Words from the EFF large wordlist by the Electronic Frontier Foundation, used under CC BY 3.0 US.
How it works
Easy to say. Hard to guess.
Made to be read aloud
Six random words carry about 77 bits of entropy - as much as a 12-character random password - and you can read them over the phone without spelling a thing.
Chosen by chance, not by you
People pick phrases that mean something, and those are the first a cracker tries. Here every word is drawn independently by your browser's cryptographic random number generator.
A list built for this
The EFF wordlist was made for passphrases: 7,776 familiar words of three to nine letters, with offensive ones weeded out. Each word adds 12.9 bits.
Common questions
How many words should a passphrase have?
Six is the usual advice and the default here, at about 77 bits of entropy. Four or five words is reasonable where guessing is rate-limited, such as a device unlock or the passphrase on a one-time link. To make a passphrase stronger, add a word: each one adds about 12.9 bits.
Do capital letters and a number make a passphrase stronger?
Barely. The strength figure assumes an attacker knows your settings, so capitals add nothing and the number adds about 3.3 bits. They are there to get past password rules that demand them. Another word is worth nearly four times as much.
Is a passphrase better than a random password?
For anything a person has to type, remember or read aloud, yes: the same strength with far fewer mistakes. For credentials that live in a password manager or a config file, a random password is more compact and does the same job.
Can I use a passphrase to protect a shared secret?
Yes, that is where it suits best. When you share a secret with a passphrase on OOBSecret, send the passphrase on a different channel from the link - if the link goes by email, read the words out on a call.
Is the passphrase sent anywhere?
No. The wordlist is part of the page and the words are picked in this browser tab. Nothing is sent to a server unless you choose to share the passphrase, and then it is encrypted in your browser first.