Diceware Passphrase Generator

Need a login you can actually remember but nobody can guess? A diceware passphrase generator turns random dice rolls into a short string of ordinary words, giving you a strong, memorable passphrase whose strength you can calculate instead of hope for. Instead of a jumble of symbols, you get a phrase that is easy to remember, easy to type, and backed by real randomness. This guide explains how the lookup works, the entropy math behind every word, and how to use the result without weakening it.

How a Diceware Passphrase Generator Works

The Diceware method was devised by Arnold Reinhold in 1995 to give ordinary people a way to build a cryptographic-grade passphrase with nothing more than dice and a printed list. Weak passwords are one of the most common flaws in computer security, and the reason is simple: people choose names, pets, and dates that feel random but are not. Diceware removes your own judgment from the choice. Each word comes from a roll, not from your memory, so no attacker can predict it from what they know about you. Use the free bulk password generator to get a result in seconds — right in your browser.

Five dice rolls make one five-digit number

For every word in your passphrase you need five dice rolls. Each roll of a six-sided die gives a digit from 1 to 6, and the five digits together form a five-digit number between 11111 and 66666. That number is a position in the word list. Roll 2, 5, 1, 3, 4 and you have 25134, which points to exactly one entry. A generator that runs in your browser simply performs those five rolls in software and shows the number so you can see how the word was chosen.

Why the word list holds 7,776 unique words

A standard list has 7,776 unique words, because six possible outcomes on each of five dice give \(6^{5} = 7{,}776\) combinations. Every combination maps to exactly one word, so every word is equally likely. The original Diceware word list favors short, simple words, and the average word is only about four letters, which keeps your phrase quick to type. Nothing about the word list has to be secret. Its security comes from the way you pick from it, not from hiding it, which is a basic principle of modern cryptography: you trust the algorithm and the randomness, never the obscurity. The complete word list of 7776 entries is published openly in many languages, from English and German to Japanese and Spanish, and any diceware word list you download works the same way. Keep one word list for the whole phrase, because mixing lists muddies the maths.

The lookup table in action

The lookup table is simply the list itself: a five-digit code on the left and a word on the right. Here is a six-word run, with example codes. Look each one up in your chosen list and write the word down.

Six lookups produce one passphrase of six random words, the same result a diceware password generator or a diceware lookup page would give you, only slower. A passphrase like this is easier to type than a string of symbols, and a passphrase gets its security from random choice plus length. Every passphrase built this way follows the same recipe, and each passphrase is checked against a single diceware wordlist. Join them with spaces or dashes, whichever separator the site you are protecting accepts, and you are done.

Diceware Password Entropy: The Math Behind Each Word

A diceware password, like any other password generator output, is only as strong as the number of equally likely outcomes behind it. That quantity is called entropy, and it is measured in bits. A coin toss carries one bit, and every extra bit doubles the work for anyone trying to guess your phrase. The beauty of Diceware is that you can compute the figure exactly, because the method is public and every word has the same chance. Run the free multilingual passphrase generator whenever you need another one — it only takes a few seconds.

Bits of entropy per word

Each word chosen from a list of 7,776 adds 12.9 bits, or more precisely 12.92 bits, to your phrase. The calculation is a base-2 logarithm of the list size:

$$H_{\text{word}} = \log_{2}(7776) \approx 12.92 \text{ bits}$$

For a phrase of \(n\) words, multiply that value by the number of words you chose:

$$H_{\text{total}} = n \times \log_{2}(7776)$$

The same maths gives the keyspace, the count of phrases an attacker would have to consider: \(7776^{n}\). Because the phrase is picked by dice, the calculation holds even if the attacker knows you used Diceware and knows exactly which list you used. Entropy stats like these show the unpredictability of the result in a single number, and they are why you should size your phrase by word count rather than by how clever it looks.

Comparing five words and six words

Early advice treated five words as the minimum, which equals 64.6 bits. A passphrase of that length guards a cryptographic key far better than a short password does. Reinhold later recommended six words, or 77.5 bits, as computing power grew. For perspective, a typed password of eight characters drawn at random from 94 keyboard characters holds about 52.4 bits, which is roughly what a four-word phrase offers. The table below shows how each added word multiplies the work.

How long a brute-force attacker needs

A brute-force attack tries phrases one after another, and on average the attacker succeeds after trying half of the keyspace. Take the six-word phrase above: \(7776^{6}\) is about 2.21 × 10²³, so half of that is roughly 1.1 × 10²³ guesses. The speed of the machine matters here. A rack of GPU cards can test billions of hashes every second, and the table assumes 25 billion guesses per second for the table. A well-funded nation state might do far better, which is why six words or more is the sensible floor. Divide the guesses by the speed and you get about 4.4 × 10¹² seconds, or around 140,000 years. Even at a trillion guesses per second the same phrase would hold out for thousands of years.

Locking a Photo Archive with Diceware Dice Rolls and Random Words

Maren, a wedding photographer, is about to format a 4.1 TB external drive that holds eleven years of client galleries. The drive travels in a camera bag, so she wants full-disk encryption, and the software asks for a passphrase she will type every time she plugs it in. She decides to build it the Diceware way, and her first instinct is five words, the old minimum.

A five-word Diceware phrase carries 64.6 bits of entropy. Before committing, she checks that figure against a realistic offline attacker: someone who copies the drive's encryption header and rents a GPU cluster testing 140 billion guesses per second. The keyspace is \(7776^{5}\), about 2.84 × 10¹⁹ phrases, so the average search covers half of it, 1.42 × 10¹⁹ guesses. At that speed it takes about 1.0 × 10⁸ seconds, roughly 3.2 years. Reinhold's own advice since 2014 is six words, so five is too weak for client data she must protect for a decade.

She raises the length to seven words. Entropy becomes 7 × 12.92 = 90.5 bits, and the average search becomes 7776⁷ ÷ 2 ÷ 140 billion, about 6.1 × 10¹⁵ seconds, or around 195 million years. Six words would land near 25,000 years, which also clears the six-word floor, but the drive will outlive her laptop and the seventh word costs only a few seconds of typing.

1. She rolls five dice seven times and writes each five-digit number, such as 52413 and 14636, on paper.
2. She looks up each code in the printed large EFF word list, not on a screen.
3. She types the seven words with spaces, rehearses them daily for a week, then shreds the paper.

The result tells her something concrete: the passphrase, not the cipher, was the weakest link, and at 90.5 bits a stolen drive stays sealed. Her next step is to seal a second copy of the seven words in an envelope for her accountant's safe, in case she ever forgets one.

Using the Diceware Method with Physical Dice

A generator in a web page is convenient, but the purest form of the Diceware method uses physical dice, a printed list, and a pencil. Reinhold himself advises against electronic versions for the most sensitive uses, since you cannot easily audit how a computer picks its numbers, and every passphrase deserves the same care as a house key. You are placing trust in the software, and trust is exactly what physical dice let you avoid. Good security habits, and real security, begin with that choice. If your threat is serious, the extra ten minutes are worth it.

Rolling five dice at once

Take five dice and roll them together, reading the digits left to right in a consistent order. Shake them well in a cup, record the five digits, and look the number up. Repeat for each word. Casino-grade dice are unnecessary; any fair six-sided dice from a board game will do. If you only own one die, roll it five times and write each result down before moving on. Whichever way you do the dice rolls, never re-roll a result just because the word looks awkward, because discarding outcomes you dislike quietly reduces your entropy.

Choosing a wordlist: EFF wordlists, Alan Beale, and more

The choice of wordlist changes how pleasant your phrase is, not how strong it is per word. The original list contains some odd abbreviations, so Alan Beale edited an alternative with fewer obscure entries. In 2016 the Electronic Frontier Foundation released three EFF wordlists that favor words which are easy to spell and to say. The large EFF wordlist keeps the 7,776-word size, so each word still adds 12.92 bits. Its short list has only 1,296 words, which cuts each word to about 10.3 bits, so you need more words to reach the same strength. Whatever you choose, make sure every entry is equally likely, and stay with one word list for a whole passphrase. A good word list for a passphrase is one you can spell, say aloud, and remember. Never edit a word list by hand to drop words you dislike, since that changes the size of the word list and the entropy per word with it. Print the word list, or keep a trusted copy, and compare the word list with the published original from time to time.

• Original list: 7,776 short words, some obscure abbreviations
• Beale list: the same size with fewer Americanisms
• EFF large list: 7,776 words, built for memory and spelling
• EFF short list: 1,296 words, four dice per word

Lists also exist in more than two dozen other languages, so you can build a phrase in the one you think in.

Adding a special character or a separator

Do you need a special character? Rarely. Length protects you far more than a squiggle does, and the NIST password guidance agrees that long, easy-to-remember secrets beat forced complexity. Some sites still insist on numbers, a symbol, or mixed case. In that case, use dice again. Two rolls pick a position in a small table of 36 symbols, which adds about 5.2 bits. Capitalize a word by rolling too, instead of defaulting to the first letter of the phrase. A random separator is safe, but plain spaces are also acceptable: the entropy estimate of 12.9 bits per word assumes words are separated, since if you simply concatenate them, ambiguous splits slightly reduce the total.

Is a Browser-Based Passphrase Generator Safe?

Safety depends on where the randomness comes from and where the result goes. A trustworthy passphrase generator in the browser follows three rules: it uses a proper cryptographic source, it never sends your phrase anywhere, and its code is open for inspection.

A cryptographically secure random number generator

The word random hides a trap, and security depends on it. Many programming functions produce numbers that only look scattered. A cryptographically secure source, by contrast, is built so that no one can predict the next value. In JavaScript that source is crypto.getRandomValues(), which fills an array with values from the operating system's random number generator. A good tool calls getRandomValues once for each simulated die and nothing else. If your browser or computer has been tampered with, even the best random number generator cannot save you, because a compromised hardware random number generator or a malicious extension can leak or bias results.

Processing locally: no logs, no uploads

The best tools run everything locally. The page loads as static files, your dice and your words are generated on your own device, and nothing is transmitted. You can check the claim yourself: load the page, switch off the network, and it should keep working. Ask also whether the site keeps access logs and whether the developers publish their source code. Open source code can be read, and anyone can audit it to confirm that no phrase leaves the page. Load it only over HTTPS, because plain HTTP lets someone tamper with the page in transit, and a TLS connection protects the script itself.

When to go air-gapped

If you protect something worth a nation-state attacker's time, use physical dice on an air-gapped machine or on paper. For everyone else, using a generator on a computer you own and control is reasonable. Do not generate secrets on a public machine, make sure nobody can shoulder surf while you work, and close the tab when you finish so the phrase does not linger on screen. Copy the result only into a password field or a secure note, never into chat.

Diceware Passphrases Versus a Password Manager

Do diceware passphrases replace a password manager? Not usually. A password manager is excellent for the dozens of accounts you rarely type. Diceware shines where memory and typing matter. Many people use the two together: let the manager create random strings for ordinary sites, and use a memorable phrase for the few secrets you must recall without help.

Where a memorable passphrase belongs

These are the places where a long phrase is the best answer:

• The master password that unlocks your password vault
• Disk encryption on a laptop, which asks for the phrase at every boot
• A Wi-Fi network using WPA2 in pre-shared-key mode
• Keys for PGP or GnuPG, where the phrase guards your private key
• The passphrase on a Bitcoin wallet backup, where length matters even more
• A Smart TV or console, where hunting for punctuation on a remote is painful

For cryptocurrency, a Diceware phrase suits a wallet's passphrase or an encrypted backup, where twelve words give about 155 bits. Standard wallet seed phrases come from a different 2,048-word list, so keep the two apart.

Phishing, two factor authentication, and passkeys

No passphrase defeats phishing. If you type a perfect phrase into a fake page, the attacker simply receives it. What helps is a unique phrase for each account, so a stolen one cannot be reused, combined with two factor authentication for every login that supports it. Passkeys go further by tying your credential to the real domain, which blocks the fake-page trick. Use them where they exist, and keep a Diceware phrase for the services that still ask for a typed secret. Treat the phrase as the last line of privacy for those services.

Common Diceware Passphrase Mistakes to Avoid

Most failures come from people tampering with the result. The XKCD comic about four common words made the idea popular, but its point is that the words must be chosen at random, not picked because they seem funny. Each of these errors weakens a Diceware phrase in a measurable way.

1. Choosing words yourself instead of rolling. Human choice is predictable, which is the whole problem Diceware solves.
2. Rerolling until you like the words. That shrinks the pool and the entropy with it.
3. Using fewer than six words for anything important; the entropy table above shows five words last only about 18 years against a fast attacker.
4. Reusing the same phrase on several sites, so one breach exposes them all.
5. Storing the phrase in a plain note on the same computer you are protecting, or pasting it into a shared document.

The remedy is dull but effective: roll, write down the words and the dice rolls only on paper, use the phrase for a few days until it settles into memory, then destroy the paper. Never photograph it, and never rewrite the words to taste. A QR code on a generator site only links to the tool, never to your phrase, so share the page and keep the words private.

Choosing the Number of Diceware Words for a Random Passphrase

How long should your random passphrase be when you build it with Diceware? Pick the length from the job it has to do, not from what feels comfortable to type. The question is how many guesses an attacker could realistically make against the thing you protect. A secret that is checked live by a website, with lockouts and rate limits, faces a few guesses per second, so even four words is generous there. A secret that protects a stolen, encrypted file faces the full speed of the attacker's hardware, and that calls for six words or more.

Match the length to the threat

Think in two situations. In an online attack the service itself slows the guesser down, so entropy beyond about 40 bits rarely matters in practice. In an offline attack the adversary holds a copy of your encrypted data or password hashes and can try guesses as fast as a graphics card allows, with no lockout. Disk encryption, a password vault, and a PGP private key all fall into that second category. For those, use at least six words, and add a seventh or eighth if the data would still matter in ten years. Computing power grows, so build in a margin.

Make the six random words stick in memory

A phrase is useless if you forget it. Try the story method: link the words into a short, silly scene, picture it for a moment, and repeat the phrase aloud a few times over several days. Type it daily at first, then less often. Build the story around the words you rolled, and never swap a word to make it easier, because that is the same mistake as rerolling. If a list keeps giving you words you cannot spell or say, pick an easier list such as the EFF one before you start rolling, not afterward. After about a week of regular use most people can recall a six-word phrase without any notes.

Check the result against a short checklist

• Every word came from a fresh roll, not from your own preference.
• The phrase has at least six words if it guards anything offline.
• The Diceware phrase is unique to a single account or device.

If every box is ticked, the strength of your secret is set by arithmetic rather than by guesswork, and that is the real promise of the Diceware approach: you always know how much security you have.

Frequently Asked Questions

What makes this "genuine" Diceware, and not just another word-based passphrase generator?

The classic Diceware method (invented by Arnold Reinhold in 1995) works by physically rolling a six-sided die 4 times per word and looking up the resulting 4-digit number in a published word list. This tool does exactly that -- it uses your browser's cryptographically secure random number generator to simulate real dice rolls, then looks each code up in the official EFF short wordlist, and shows you every roll so you can verify the process yourself.

Why does the entropy grow so fast with each extra word?

Each word is chosen from 1,296 possibilities (6⁴, since each word needs 4 dice rolls), which is about 10.34 bits of entropy per word. Six words gives roughly 62 bits total -- comparable to a fully random 10-character password using upper/lower/numbers/symbols, but far easier to memorize and type.

Why use the EFF's word list instead of the original Diceware list?

The EFF (Electronic Frontier Foundation) published this list specifically to fix weaknesses in the original 1995 Diceware list -- removing offensive terms, avoiding words that are hard to spell or too similar to each other, and keeping every word short (5 characters or fewer) so passphrases stay easy to type. It's the version security professionals commonly recommend today.

Is a rolled word ever repeated in one passphrase?

It's not prevented -- each word is an independent dice roll, exactly like rolling physical dice repeatedly. A repeat is possible but statistically rare at typical word counts, and forbidding it would technically reduce the passphrase's true entropy below what the dice rolls represent.

Is anything about my generated passphrase sent anywhere?

No. Every dice roll and word lookup happens entirely in your browser using the Web Crypto API's cryptographically secure random number generator -- nothing is transmitted, logged, or stored.