PassphraseKit uses the EFF large wordlist, designed for this purpose with words that are easy to spell and recognise. Add capitals, a number or a symbol if a site insists on them.
How the passwords are made
PassphraseKit draws every character, word and digit with crypto.getRandomValues, the browser’s cryptographically secure random number generator, the same source used for encryption keys. To keep each choice exactly uniform it uses rejection sampling: random numbers that would make some characters slightly more likely than others are thrown away and drawn again. The page makes no network requests while generating, and generated passwords are never written to storage. Only your settings, such as length and character types, are remembered on this device.
Random character passwords pick from the character types you select and are regenerated until they contain at least one character of each type, which satisfies most website rules without making any position predictable. Passphrases pick words from the EFF large wordlist of 7,776 words, published by the Electronic Frontier Foundation under a Creative Commons Attribution licence, so each word adds log₂ 7,776, about 12.9 bits.
Reading the strength meter
Entropy measures how many equally likely possibilities a generator could have produced. A 16-character password from 62 letters and digits has about 95 bits; a five-word passphrase about 65 bits; a six-digit PIN about 20 bits. Every extra bit doubles an attacker’s work. The crack-time estimate assumes ten billion guesses per second, a realistic rate for a stolen database protected by a fast hash; slow password hashes and online logins are millions of times slower. These figures apply to generated passwords, where the method is known but the randomness is not.
Checking a password you already have
People are poor at randomness, so a typed password is weaker than its length suggests. The strength checker gives a rough, cautious estimate: it counts length and character types, then discounts repeats, sequences like 1234 or qwerty, and common passwords even when letters are swapped for symbols. It is a guide, not a guarantee; the safest fix for a weak password is a fresh one from the generator, stored in a password manager and used on one site only.
Frequently asked questions
How many words should a passphrase have?
Five or more for online accounts, six or more for a password manager master password or disk encryption.
Is a passphrase better than a password?
For things you must remember and type, yes. For everything stored in a password manager, a long random password is fine.
Can I pick the words myself?
No. Words chosen by people are far more predictable. Let the generator choose, and regenerate until you get one you like.
Is PassphraseKit free?
Yes, with no sign-up. Only your settings (length, options) are remembered on this device.
Are generated passwords stored?
No. They exist only on the page until you close or regenerate it.