How the passphrase generator works
Last updated 10 November 2026
Long passphrases made of random words can be as strong as short random passwords and are much easier to type and remember.
How it works
- Words are picked at random from a list written for this site.
- Strength in bits = number of words × log base 2 of the list size.
Why a passphrase
Passwords such as a short jumble of symbols are hard to remember and easy to reuse. A passphrase is a string of random words. It is longer, so it is harder to guess, and it is easier for a person to type and remember. The key is that the words are chosen at random and not by you.
How the strength is worked out
Each word is picked at random from a list. The strength in bits is the number of words multiplied by the base-two logarithm of the list size. In plain terms, every extra word multiplies the number of possible passphrases by the size of the list. Adding a word is the simplest way to make a passphrase much stronger.
Random is the point
- A phrase you pick yourself, such as a song line or a family name, is far easier to guess than random words.
- Changing letters to symbols, such as a for @, adds very little strength.
- If you do not like the words you get, generate a new set instead of swapping words by hand.
Good habits
- Use a different passphrase for every important account.
- Use more words for the accounts that matter most, such as email and banking.
- Store passphrases in a password manager if you have too many to remember.
- Turn on two-step sign-in wherever it is offered.
Where the words come from
The words are chosen with your browser's secure random number generator and are never sent anywhere. Nothing is saved when you leave the page, so copy the passphrase before you close it. See also the password generator when a site needs a short, mixed-character password.
Things to watch
- Use at least six words for important accounts.
- Use a different passphrase for every account.
Nothing generated here is stored or logged.
Like every tool on MoneyMzansi, this one runs entirely in your browser. There is no account, no upload and no sign-up, so it keeps working even if your connection drops once the page has loaded.