Password Generator With Words
The password generator with words draws 3 to 12 words at random from a list of 585 common English words and shows the strength in bits: eight words give 73.5 bits. Choose how many words and how to join them, then press Generate.
Sources: EFF, NIST Updated
How the password generator with words builds a password
The page holds a list of 585 common English words of three to nine letters. For each word in your password it makes one unbiased draw from the whole list, using the browser's cryptographic random generator, and joins the words with the separator you chose.
Nothing about the result is chosen by a person, which is the point: people pick predictable words, a random draw does not. The method behind every draw on this site is described in how our randomness works.
strength in bits = words × log2(585) = words × 9.19
two random digits: + 6.64 bits · one of 8 symbols: + 3 bits
A password with b bits is one of 2b equally likely possibilities. Each extra bit doubles the number of guesses an attacker needs. Capital letters at the start of each word are applied to every word, so they add nothing.
Example: an eight-word password and its strength
Eight words, hyphens, no extras: lemon-argue-silver-window-brave-carry-meadow-quiet. Each word is one of 585, so the strength is 8 × 9.19 = 73.5 bits. Adding two random digits brings it to 80.2 bits.
How strong is a word password? Bits by number of words
| Words | Bits | With digits and symbol |
|---|---|---|
| 3 | 27.6 | 37.2 |
| 4 | 36.8 | 46.4 |
| 5 | 46.0 | 55.6 |
| 6 | 55.2 | 64.8 |
| 7 | 64.3 | 74.0 |
| 8 | 73.5 | 83.2 |
| 9 | 82.7 | 92.4 |
| 10 | 91.9 | 101.6 |
| 12 | 110.3 | 119.9 |
For comparison, the Electronic Frontier Foundation recommends at least six words from its long list. That list is used with five dice per word, which makes 7,776 words and about 77.5 bits for six words. You can roll the five dice in the dice roller if you want to try the EFF method.
Because the list here is shorter, the same strength takes 9 words.
How to use a word password well
- Use it where you have to type or remember the password: a computer login, a Wi-Fi key, the master password of a password manager.
- Take the password as generated. Regenerating until you like the words, or swapping a word for a favourite, removes the randomness the strength is based on.
- Use a different password for every account, and switch on two-step verification where a site offers it.
- Leave the words as they are. NIST's password guidelines tell sites not to demand a mix of character types; where a site insists anyway, tick the digits or symbol option instead of editing the password by hand.
For a password that does not need to be typed, a string of random characters from the random sequence generator packs more bits into fewer characters. For single words to play with rather than to protect an account, use the random word generator.
Questions about the password generator with words
Is a password made of words safe?
It depends on two numbers only: how many words the list holds and how many words you draw. What the words are does not matter, as long as each one is drawn at random and not chosen by you. This page shows the result in bits so you can judge it; see the table above.
How many words should I use?
The Electronic Frontier Foundation suggests at least six words from a list of 7,776, which is about 77.5 bits. The list on this page is much shorter, so it takes 9 words to pass that mark. The default here is eight words, 73.5 bits.
For an account that matters, use a password manager and let it generate and store a long random password. Keep word passwords for the few you must type or remember.
Why are there no options to swap letters for symbols?
Predictable swaps such as a → @ or e → 3 follow a pattern that is easy to guess, so they add very little strength while making the password harder to type. The earlier version of this page offered them and scored the result with a simple point system that called short passwords “very strong”. Both were removed.
A random two-digit number and a random symbol are still offered because many sites insist on them; each adds a known, small amount of strength.
Is the password sent or stored anywhere?
No. It is put together in your browser and exists only on your screen until you copy it. It is not saved in local storage, and leaving the page discards it.
Can a word appear twice?
Yes. Each word is drawn independently from the whole list, which is what makes the strength easy to state exactly. With eight words from this list a repeat happens in fewer than 5% of passwords, and it does not weaken the result.
Sources
- EFF: Dice-generated passphrases — “We recommend selecting a minimum of six words from our long wordlist, or when using any other list of this size.” (checked October 16, 2026)
- MDN: Crypto.getRandomValues() — the random source used to pick each word (checked October 16, 2026)
- NIST SP 800-63B: Digital Identity Guidelines — section 5.1.1.2: verifiers should not impose composition rules such as mixing character types (checked October 16, 2026)