Frequently Asked Questions
What is a passphrase?
A passphrase is a sequence of random words used as a password — for example: correct-horse-battery-staple. Passphrases are typically 4-6 words long, giving them 20-30+ characters. They are significantly harder to crack than traditional passwords because of their length, yet easier for humans to remember than a string of random characters like K9$mPq2#vL7n.
Is a passphrase more secure than a password?
Yes — for most uses. A 4-word random passphrase has approximately 7.2 quadrillion possible combinations using a 7,776-word wordlist (the Diceware standard). The UK's National Cyber Security Centre (NCSC) and the US National Institute of Standards and Technology (NIST) both recommend passphrases as a strong, memorable alternative to complex passwords. Length is the most important factor in password security — and passphrases win on length.
How many words should a passphrase have?
The NCSC recommends a minimum of 3 random words for general accounts, and 4-6 words for high-value accounts such as email, banking and password managers. Each additional word multiplies the possible combinations by the size of the wordlist — so a 5-word passphrase is approximately 7,776 times harder to crack than a 4-word passphrase using the same wordlist. For maximum security use 6+ words.
Where should I use a passphrase?
Passphrases are ideal for accounts you type manually rather than autofill — your computer login, password manager master password, email account and any account where you need to remember the password. For accounts where you use a password manager to autofill, a long random password is equally secure. Use passphrases where memorability matters.
Is this passphrase generator truly random?
Yes. This generator uses window.crypto.getRandomValues — the browser's built-in cryptographically secure random number generator, the same standard used in security software. The generation happens entirely in your browser. No passphrase is transmitted to any server or stored anywhere. Each generation is completely independent and unpredictable.
Can I use a passphrase as my password manager master password?
Yes — this is one of the best uses for a passphrase. Your password manager master password needs to be both very strong and something you can reliably remember and type. A 5-6 word random passphrase is ideal. Generate one, write it down temporarily while you memorise it, then destroy the paper. Practise typing it a few times each day until it becomes automatic.
What is the difference between a passphrase and a password?
A password is typically a shorter string of mixed characters (letters, numbers, symbols) — for example K9$mPq2#. A passphrase is a sequence of random words — for example correct-horse-battery-staple. Passphrases are generally longer (20-30+ characters vs 12-16) making them harder to crack by brute force, while being significantly easier to remember. For accounts you need to type manually, passphrases are the better choice.
