Tool · Diceware method
A phrase you can remember and nobody can guess
For the handful of passwords you genuinely have to memorise, several random words beat a short jumble of symbols. And they type without mistakes.
Words chosen at random
silla-mitad-gente-montaña-verano-café
Approximately 46 bits of entropy · Words are selected in your browser using secure randomness.
Where the dice come into it
The method is called Diceware and dates from 1995. The original idea was to roll five dice, form a five-digit number and look it up in a list of 7,776 words. You repeated it a few times and the result was your password.
The dice were not an eccentricity: they were how you guaranteed the choice was genuinely random, without a person or a computer you had to trust in the loop. This tool does the same using the browser's cryptographic randomness source, which is of equivalent quality for the purpose.
Why words rather than symbols
Because human memory works with images, not with character strings. A sequence likevinegar stencil rhombus broom ivory is absurd, and that absurdity is what makes it memorable: two or three days of use and it sticks. x7#Kq2 attaches to nothing and is gone the same day.
And on strength, it is not even close:
| Password | Entropy | Memorable |
|---|---|---|
House#2024 | Low — falls into known patterns | Yes |
x7$Kq2Lp | ~52 bits | No |
| 5 random words | ~64 bits | Yes |
| 6 random words | ~77 bits | With effort |
Each word drawn at random from 7,776 contributes about 12.9 bits. And since every bit doubles the attacker's work, going from five words to six multiplies the cost of cracking it by nearly eight thousand.
Where to use one, and where not to
Yes, clearly:
- Your password manager's master password. It is the only one you will type daily.
- Your main email, if you do not keep it in the manager.
- Your computer or laptop login.
- Anywhere the keyboard is awkward: a television, a games console.
Not needed: for every other account. You do not have to remember those, so a random character key from thegenerator is quicker to type and more than enough.
Three things not to do with your phrase
- Swap out the words you dislike. The moment you choose, you stop being random. If a word does not sit right, generate the whole phrase again.
- Reorder them to make sense. A grammatical sentence is far more predictable than five loose words.
- Reuse it. The same rule as any password: one per site.
Frequently asked
Common questions
Is a password made of ordinary words really secure?
Yes, if the words are chosen at random and there are enough of them. Five words drawn randomly from a list of nearly eight thousand come to about 64 bits of entropy, more than most ten-character passwords people invent.
Does it matter that the word list is public?
No. The security lies in the randomness of the choice, not in hiding the method. An attacker who knows exactly which list was used still has to try every possible combination.
Can I pick the words myself if I like them better?
That is precisely what not to do. Words chosen by a person come out related to one another and from a small vocabulary, and the real strength drops by more than half.
How many words do I need?
Five for general use, six for a master password or your main email. Four is short for anything important.
Where to go next