Passphrases are sampled words
A dictionary passphrase joins independently selected words with separators. This page shuffles a fixed local list and takes distinct words, so a five-word result might be “canyon-orchid-raven-harbor-quartz.” The words are generated in the browser and never sent to a server. Memorability comes from recognizable words; resistance to guessing comes from how many possible word sequences an attacker must consider, not from decorative punctuation alone.
Entropy calculation
If a list contains W equally likely words and n positions, the ideal selection space is W^n and the information estimate is n × log2(W) bits. The built-in list has 46 words. Five words give 5 × log2(46) ≈ 27.6 bits before accounting for the no-repeat rule. That is suitable for a memorable low-risk phrase, not a claim of high-security protection. A larger curated word list and more words raise the space sharply: 46^8 is far larger than 46^5.
Worked numbers
Choose five words and suppose the tool outputs “cedar-stream-planet-hazel-ember.” There are five visible components and four hyphens. Replacing hyphens with spaces does not make the selection more random; it only changes the allowed format. Adding a personal predictable suffix such as 2026 may satisfy a website rule but adds little uncertainty because it is easy to guess. If a service permits it, adding two more randomly chosen words is generally stronger than adding a familiar symbol.
When to use one
A long passphrase works well for an account protected by a password manager, an encrypted local file, or a Wi-Fi key when the system accepts spaces or hyphens. It is less appropriate for sites with short password limits, systems that normalize punctuation, or high-value accounts that require a unique generated password plus multi-factor authentication. Never reuse a phrase across services. A breach of one service turns a reused memorable secret into a testable guess elsewhere.
Important limitations
The word list is intentionally small enough to inspect and is not a replacement for a security-audited password manager. Browser randomness is used when available, but this page cannot verify the security of a device, clipboard, browser extension, or compromised account. Avoid showing a generated phrase on a shared screen. Copying it to a cloud clipboard can create another exposure. Treat this generator as a local convenience for human-friendly phrases, not a credential vault.
How it differs
The random password generator chooses individual characters from an alphabet; its strength rises with length and alphabet size but its output is harder to remember. This page chooses words and shows an approximate word-selection space. A UUID generator is for identifiers, not secrets people type. Use this page when readability and deliberate word count are the design constraints.
Choosing a usable phrase
Count words rather than characters when comparing generated phrases. “canyon-orchid-raven-harbor-quartz” is long because it has five independent choices; changing its capitalization changes appearance but not the chosen words. If a site rejects spaces or hyphens, use the separator it accepts without deleting a word. A phrase should be unique to one account, stored in a password manager if possible, and protected with multi-factor authentication. Do not select favorite words from the displayed list or edit the result into a sentence: human choices introduce patterns that a random selection avoids. A work policy may require a minimum length or character class; satisfy that policy by adding non-predictable material supplied by the policy, not by shortening the word count. Regenerate immediately if anyone else saw the phrase. The estimate on screen measures only this tool’s word choices; it is not a guarantee about a service’s hashing, rate limits, recovery process, or device security.
Match the phrase to the account policy
A five-word phrase from this 46-word list has about 27.6 bits before any site rule, because the page selects without repeating a word. That estimate is not equivalent to a password manager's much larger source. High-value accounts need a unique manager-generated credential and multi-factor authentication. The displayed phrase is not a recovery answer, encryption key, or secret that remains safe after it has appeared in a shared browser.