Diceware Passphrase Generator

Generate Strong Memorable Passphrases — Diceware

Diceware is the cryptographic gold standard for memorable, high-entropy passphrases. Pick three to ten random words from a curated wordlist, string them together with separators, and you get something a human can memorize in 30 seconds but an attacker cannot realistically brute-force at higher word counts. CipherForces Diceware uses its own hand-curated 512-word list — exactly 2^9 words, so every word contributes a clean 9 bits of entropy — tuned the same way the classic Diceware lists are: no homophone pairs (no "their/there"), no offensive words, no embarrassing combinations.

Why Passphrases Beat Passwords

A 12-character random password (~72 bits of entropy) takes roughly the same number of guesses to crack as an 8-word passphrase from this generator (72 bits — 9 bits per word). The difference: humans cannot memorize X#7$pq2!Lm9k but absolutely can memorize correct.horse.battery.staple. Pinned to the wall above your desk would be more secure than reusing one weak password across every account.

Common Use Cases

• Master password for a password manager: Diceware is what 1Password and Bitwarden recommend in their official documentation.
• Disk encryption (FileVault, BitLocker, LUKS): Has to be memorable; needs to be very long. Exactly the Diceware sweet spot.
• SSH key passphrase: Same reasoning — never typed under attack pressure, but needs to be unguessable.
• Recovery phrases for backup encryption: Print and store in a safe.

Configurability

• Word count: 3 (low security) to 10 (paranoid). 5–7 is the sweet spot.
• Wordlist: a curated 512-word list of common 4–7-letter English words (2^9 words — exactly 9 bits of entropy each), bundled with the page.
• Separators: period, dash, space, none, or random punctuation.
• Capitalization: none, first letter, all caps, or random.
• Add a digit/symbol: tail one on for compliance with stupid corporate password rules.
• Bulk generation: generate 10/50/100 at once and pick the one you like.

Privacy: Word selection uses the browser's crypto.getRandomValues() — cryptographically random, never seeded from any predictable source. The wordlist is bundled with the page; no network call ever happens. Open DevTools → Network → generate any number of passphrases → see zero requests.