- Why a passphrase instead of a password?
- Because humans are bad at remembering high-entropy strings. tH7$kQ9!mP2@ has about 78 bits of entropy and is unmemorable; correct-horse-battery-staple-anchor-yodel has the same entropy and you can repeat it back to yourself after one read. XKCD's 936 comic made this argument famous. The math has held up since.
- What's the EFF Long Wordlist?
- A 7,776-word English wordlist published by the Electronic Frontier Foundation in 2016 for Diceware-style passphrase generation. It was curated to be memorable, easy to type, free of slurs, and roughly the same length per word so passphrases feel uniform. Each word contributes log2(7,776) ≈ 12.92 bits of entropy. We use it because it's the de facto modern standard.
- What do entropy bits actually mean?
- Bits of entropy is the log2 of the number of possible passphrases your settings can produce. 77.5 bits = 2^77.5 ≈ 2.1×10^23 possibilities. Even at one trillion guesses per second (top-tier offline cracker), trying them all would take about 6,700 years. 50 bits is fair (online attacks deterred), 70+ is strong (offline attacks deterred), 100+ is overkill for everything except adversaries with state-level budgets.
- How many words should I pick?
- 6 is the sweet spot for most uses: ~77.5 bits of entropy and still memorable. 4 words (~52 bits) is fine for low-stakes accounts. 8+ words (~103+ bits) is the right move for master passwords on a password manager, encryption keys, or anything you'd hate to lose. More words = more entropy, linearly.
- Is this safe to use?
- The selection is cryptographically secure: crypto.getRandomValues is the browser's CSPRNG, the same source TLS and WebAuthn use. The wordlist is fully embedded in this page — nothing is fetched, transmitted, or logged. With that said: don't paste a real passphrase into any chat, screenshot, or cloud document. The weakest link is almost always the human storage step, not the generation step.
- Should I capitalize words or add a digit?
- Not for security — those tweaks add a tiny amount of entropy (capitalize adds ~1 bit per word, a trailing digit adds ~3.3 bits). The real reason to enable them is to satisfy password rules that demand 'must contain uppercase' or 'must contain a number.' If your target system doesn't require them, leave them off — the passphrase is easier to type and remember.
- Why not Math.random()?
- Math.random() in browsers is a non-cryptographic PRNG: it's fast, but its output is predictable from prior outputs and is not safe for keys, tokens, or passphrases. We use crypto.getRandomValues, which routes to the OS's secure entropy pool (urandom on Linux, BCryptGenRandom on Windows, SecRandomCopyBytes on macOS). Every word slot is also reject-sampled to eliminate modulo bias — 2^32 mod 7,776 isn't zero, so a naive picker would slightly favor early words.
- Will I actually remember this?
- Yes — that's the whole point. The EFF list was tuned for memorability. Repeat the passphrase out loud three times when you generate it; visualize each word; write it down once and shred the paper after you've recalled it from memory. For a master password, also store it in two physical places (a sealed envelope in a desk drawer; a sealed envelope at a trusted person's house) — that's the threat model behind passphrases: human-memorable, with a paper fallback.
- Can I use this for a password manager master password?
- Yes — Diceware is specifically what password manager vendors recommend for this purpose. Pick 7 or 8 words (about 90–103 bits), capitalize if the manager requires it, and never reuse the passphrase anywhere else. Bitwarden, 1Password, and KeePass all officially endorse Diceware-style master passphrases over short complex passwords.
