Passphrase generator

A passphrase is a password made of several words, like velvet-oyster-plaza-gently-mural-fiber. Because each word is picked at random from a list of 7,776, it is long and hard to guess, yet much easier to remember and type than a jumble of random characters.

Six words is a good default: about 77.5 bits, which would take about 350 thousand years to guess on average at 10 billion guesses a second. Use at least five for anything that matters, and seven or more for a master password that protects other passwords. Each extra word multiplies an attacker's work by 7,776.

Diceware is a way to make passphrases with ordinary dice, created by Arnold Reinhold in 1995. You roll five dice for each word and look the five numbers up in a list of 7,776 words, one for every possible roll. This page uses the EFF large word list, which was made for exactly that. Switch to Diceware view to see the rolls behind each word, or type in rolls from your own dice to look a word up.

Strength comes from length and randomness, not from looking complicated. Six random words carry about as much randomness as 12 random characters from the whole keyboard, and are far easier to remember. NIST's Digital Identity Guidelines (SP 800-63B) tell services to accept passwords of at least 64 characters, including spaces, and not to impose composition rules such as mixing character types, which suits passphrases. The words must be random, though: a quote, a lyric or words you chose yourself are much easier to guess.

From how the passphrase was made, not from how it looks. Each word is one of 7,776, so it adds about 12.92 bits. Random capitals add 1 bit per word, a random digit or symbol between words about 4.7 bits per gap, a digit at the end 3.3 bits and a symbol 4 bits. Fixed choices like a hyphen or capital first letters add nothing. The time to guess assumes an attacker who knows the word list and your settings and tries 10 billion guesses a second, finding it halfway through on average.

No. Passphrases are made in your browser with its cryptographic random generator and are never sent to Trezio or anyone else. They are not saved in this browser either, so a refresh makes them gone for good. Only your options, like the number of words and the separator, are kept in this browser's local storage so the page opens the way you left it. A copied passphrase stays on your clipboard until you copy something else.

This page makes a passphrase and forgets it. Trezio is where you save links, notes, screenshots and voice notes, with an encrypted vault for logins: the browser extension and the Android app can save a login with a screenshot of its sign-in page, encrypted on your device with AES-256-GCM. Your master password never leaves your device. There's a free plan.