Random passwords
A random character password draws each position from enabled character sets. ToolBullet uses browser cryptographic randomness and rejects candidates until every selected class appears. Its displayed bits are the logarithm of the exact number of strings that satisfy those generator settings.
Random passphrases
A passphrase can be easier to type and remember when it consists of independently selected random words. ToolBullet uses the EFF large wordlist of 7,776 entries. Each independently selected word contributes log2(7,776), about 12.9 bits, under that generation model. Five words therefore provide about 64.6 bits before optional random additions; six provide about 77.5 bits.
The model matters
Those figures do not apply to a quotation, lyric, personal phrase or words chosen by a person. Predictable selection, editing and reuse can substantially reduce practical guessing resistance. Separators and capitalisation are not counted unless they are themselves selected randomly.
Which should you use?
Use a password manager’s long random password where convenient. A random multi-word passphrase can be useful where you must type or remember the credential. In both cases, make it unique, follow the service’s policy and enable multi-factor authentication.
Sources and further reading
EFF Dice-Generated Passphrases, NIST SP 800-63B-4, and the Web Cryptography API. Sources reviewed 23 June 2026.