Diceware Passphrase Generator (EFF wordlist, secure & local)
Generate memorable Diceware passphrases from the EFF wordlist with cryptographically secure randomness β created in your browser, never sent or stored. Word count, separators, capitalization, numbers and a live entropy estimate.
π Runs entirely in your browser. Your input and output are never sent to a server or stored β fully private.
π² Generated in your browser with crypto.getRandomValues β the passphrase never leaves your device; nothing is sent or stored. Words come from the EFF short wordlist 2.0 (1,296 words β 10.34 bits each). 5+ words is a solid master password; 6+ for long-term secrets.
About this tool
A passphrase you can actually remember, generated where nobody can see it: this tool rolls Diceware-style passphrases entirely in your browser, so the words never leave your device or appear in any log. Each word is drawn from the EFF short wordlist of 1,296 memorable words using the browser's cryptographically secure randomness β the digital equivalent of fair dice rolls β and contributes about 10.3 bits of entropy. The running entropy count shows exactly how strong your phrase is as you add words. Great for master passwords, disk encryption and Wi-Fi keys.
Frequently asked questions
Why is a passphrase of plain words stronger than something like Tr0ub4dοΌr!?
Because strength comes from entropy β the number of equally likely possibilities β not from how weird a password looks. Substitutions like 0-for-o follow patterns cracking software tries first, so a short complex password holds far less entropy than it appears to. Each random word from a 1,296-word list adds about 10.3 bits; six words give roughly 62 bits, more than a truly random 10-character mixed password, while being vastly easier to remember and type correctly.
What does Diceware mean, and are the words really random?
Diceware is the classic method of picking passphrase words by rolling physical dice: four rolls of a six-sided die give 6β΄ = 1,296 outcomes, one per word in the EFF short wordlist. This tool performs the same fair rolls digitally using crypto.getRandomValues, the browser's cryptographically secure generator, with rejection sampling so every word has an exactly equal chance β no bias, no predictable Math.random. Because the method is public, the strength rests purely on the randomness, not on secrecy.
Could the generated passphrase be seen or stored by anyone?
No. The wordlist ships with the page and every roll happens locally in your browser, so the passphrase is never transmitted, logged or stored β there is nothing for a server to see. Once the page has loaded you can disconnect from the network and keep generating. For extra caution with a high-value passphrase, generate it offline, memorize it or store it in a password manager, and simply reload the page to clear the result.