How is a passphrase different from a password?

A passphrase is several random dictionary words joined together (diceware-style). It is easier to type and remember than a random character string of similar entropy, while remaining hard to guess when words are chosen with a CSPRNG from a large list.

How large is the wordlist?

This tool uses 2048 common English words (4–8 letters). Each word contributes about 11 bits of entropy when chosen uniformly. Six words ≈ 66 bits; eight words ≈ 88 bits.

Is this a password manager?

No. We generate the passphrase in your browser and never store it. Copy it into Bitwarden, 1Password, or another vault for storage and autofill.

Can I use a passphrase as a JWT_SECRET?

Prefer raw CSPRNG bytes (hex/base64url) for JWT HMAC secrets. Passphrases are better for human-entered account passwords. If you must use a passphrase for signing, use a long one and prefer a dedicated JWT Secret Generator.

Tool

Passphrase Generator

Diceware-style memorable passphrases from a 2048-word list. CSPRNG picks — client-side only.

Runs entirely in your browser — no data sent to servers. Privacy policy

Prove it runs locally

Open DevTools → Network tab
Click Generate
Confirm zero outbound requests for the secret

Generation uses crypto.getRandomValues() in your browser. Privacy policy

Word count6 words

412

Separator

Capitalize wordsAppend digitAppend symbol

Generated passphrase

Click "Generate passphrase" to create a memorable high-entropy phrase

Press R to regenerate · 2048-word list (~66 bits for 6 words). Not a password manager.

Choose a word count (4–12). Six words from a 2048-word list is about 66 bits of entropy — strong for human-typed secrets; use more words for higher assurance.

Pick a separator (hyphen, space, or dot). Optionally capitalize words, append a random digit, or append a symbol for sites that require mixed case or special characters.

Click Generate passphrase, reveal if needed, and copy the result into your password manager. This tool does not store or sync secrets.

const crypto = require('crypto');
const words = ['correct', 'horse', 'battery', 'staple']; // use a full wordlist in production
function pick(list) {
  return list[crypto.randomInt(list.length)];
}
const passphrase = Array.from({ length: 6 }, () => pick(words)).join('-');
console.log(passphrase);

const crypto = require('crypto');
const words = ['correct', 'horse', 'battery', 'staple']; // use a full wordlist in production
function pick(list) {
  return list[crypto.randomInt(list.length)];
}
const passphrase = Array.from({ length: 6 }, () => pick(words)).join('-');
console.log(passphrase);

import secrets
words = ['correct', 'horse', 'battery', 'staple']  # use a full wordlist in production
passphrase = '-'.join(secrets.choice(words) for _ in range(6))
print(passphrase)

import (
    "crypto/rand"
    "fmt"
    "math/big"
    "strings"
)

var words = []string{"correct", "horse", "battery", "staple"} // full wordlist in production

func passphrase(n int) string {
    out := make([]string, n)
    for i := range out {
        idx, _ := rand.Int(rand.Reader, big.NewInt(int64(len(words))))
        out[i] = words[idx.Int64()]
    }
    return strings.Join(out, "-")
}

fmt.Println(passphrase(6))

Continue learning

ToolsPassword GeneratorSession Secret GeneratorJWT Secret Generator

GuidesNode.jsPythonGoJavaRuby

ArticlesHow to Store JWT Secrets SecurelyHex vs Base64 SecretsJWT Best Practices Checklist

GlossaryCryptographic EntropyJWT Secret Entropy

CompareHex vs Base64 JWT SecretsEnvironment Variables vs HashiCorp Vault

How to Use This Tool

Continue learning