How to use the passphrase generator
A passphrase strings several ordinary words together instead of scrambling symbols. People remember it as a small picture or story, while its length makes it expensive for a machine to guess. This generator draws words at random from a built-in list, joins them with hyphens, and can append two digits at the end if a site insists on numbers.
The words are chosen with the browser's cryptographic random number generator. The everyday random function is predictable enough that it should never be used for secrets. Values that fall outside an even range are discarded and redrawn so every word stays equally likely. On a very old browser that lacks the cryptographic generator the code falls back to the ordinary one, so do not rely on the output in that situation.
Entropy is calculated from the size of the word list and the number of words. This list holds 128 words, which is exactly seven bits per word. The widely used Diceware list has more than seven thousand words and therefore carries almost thirteen bits each, so reaching the same strength here simply takes more words. Eight or more is a sensible floor for an account that matters. Everything is generated inside your browser and nothing is transmitted.
Frequently Asked Questions
Each word from this list is worth seven bits, so six words give forty-two. For email or banking, eight or more words brings you close to sixty bits, which is a far safer floor.
No. Every position is drawn independently from the whole list, so a repeat is possible and the entropy figure already assumes that. Forbidding repeats would actually shrink the number of possibilities.
No. The word list and the generator both live in the page, and nothing is sent to a server. Do keep in mind that anyone watching your screen can still read it.