How many words do I need?

Six words from a 7,776-word list gives roughly 77 bits, which is comfortably beyond offline cracking. Five gives about 64 bits — fine for most accounts, marginal for a master password.

Is a passphrase stronger than a random password?

Per character, no; per unit of human memory, yes. A 20-character random string beats a five-word phrase on entropy but cannot be memorised or dictated reliably.

Does capitalising or adding a number help?

Barely — a couple of bits at most, while measurably hurting memorability. Add another word instead: that is 12.9 bits.

Is the phrase generated privately?

The word draw uses a cryptographically secure random source. Treat any generated secret as compromised if you leave it on screen or in a clipboard history you do not control.

Security🌐 YAS server-sideAPI availablebeginner

Passphrase Generator

Generates diceware-style word passphrases — long, memorable and strong.

Processed by YAS · not stored

Ready to runInstant execution

All tools →

Loading tool…

What does this tool do?

Generates diceware-style word passphrases — long, memorable and strong.

Why would I use it?

You want a strong password you can actually remember.
You are choosing master passwords or SSH passphrases.
You prefer words over random gibberish.

Real-life example

Input

5 words

Output

correct-horse-battery-staple-tin

Each word adds ~13 bits of entropy from a large wordlist.

Input → Process → Output → Next

Input: Choose word count.
Process: YAS picks random words with crypto randomness.
Output: A hyphenated passphrase with entropy estimate.
Next action: Use it with a password manager; write it down offline if needed.

Common mistakes

Using fewer than 4 words.
Choosing words yourself (lowers entropy).
Using a famous phrase from the internet.

What the result means

Entropy grows with word count; 4–6 words is typically strong.

Privacy & security

Your input is sent to YAS infrastructure because the tool requires server-side processing or public network queries. Input is not stored.

API

Endpoint

POST https://yas.sh/api/v1/tools/passphrase-generator

Request Header

Content-Type: application/json

cURL

curl -X POST "https://yas.sh/api/v1/tools/passphrase-generator" \
  -H "Content-Type: application/json" \
  -d '{"words":6}'

JavaScript

const res = await fetch("https://yas.sh/api/v1/tools/passphrase-generator", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
  "words": 6
}),
});
const data = await res.json();

Python

import requests

r = requests.post("https://yas.sh/api/v1/tools/passphrase-generator", json={"words":6})
data = r.json()

Field	Type	Required	Description
words	integer	No (default 6)	Word count (3–12)
separator	string	No (default -)	Separator between words

Success response

{ "wordCount": 6, "entropyBits": 78.2, "result": "maple-saturn-quill..." }

Diceware-style word passphrases with an entropy estimate.

Error responses

400 VALIDATION_ERROR — invalid input or unsupported option.
413 PAYLOAD_TOO_LARGE — input exceeds the 64 KB limit.
429 RATE_LIMIT_EXCEEDED — rate limit exceeded (60 req/min).

Limits

Maximum input: 64 KB per request.
Rate limit: 60 requests/min per IP address.
Authenticated accounts benefit from higher tier quotas.

How Passphrase Generator works

A Diceware-style passphrase is built by drawing words uniformly at random from a fixed wordlist using the platform CSPRNG. Entropy is words × log2(listSize): a 7,776-word list contributes 12.9 bits per word, so five words carry about 64 bits and six about 77. The strength comes entirely from the uniform random draw — a human choosing five words from the same list produces a far weaker result because human choice is not uniform.

The security argument assumes the attacker knows your method: the wordlist, the number of words and the separator. That is the correct assumption, and it is why entropy is computed from list size rather than from the character length of the result. A 30-character passphrase from a small list is weaker than a 20-character one from a large list.

When to use it: real-world scenarios

A master password you must type from memory

Password-manager master passwords cannot live in the manager. Six random words are memorable after a few repetitions and remain far beyond offline brute force.

Full-disk or backup encryption keys

FileVault, LUKS and restic passphrases are typed rarely and must survive being written down once during setup. Word-based phrases transcribe without ambiguity.

Credentials entered on a TV, console or phone keypad

Typing symbols on a D-pad is error-prone. Words entered from a soft keyboard are quicker and produce fewer lockouts.

Shared credentials read aloud during handover

Words survive a phone call; a random symbol string does not. This alone prevents a category of transcription incidents.

Pro tips

Use at least six words for anything protecting other credentials. Five is adequate for low-value accounts; four is not adequate for anything.
Do not substitute characters for letters (h0rse instead of horse). It adds almost no entropy and destroys memorability — attackers model these substitutions.
Keep the separator simple and consistent. Its contribution to entropy is negligible; its contribution to typing errors is not.
Never edit the generated phrase to make it more meaningful. Any human intervention breaks the uniformity the entropy figure depends on.

Limitations and edge cases

What this tool deliberately does not do, and where it will disagree with other implementations.

Passphrases are longer to type than random strings of equivalent strength, which matters on sites with restrictive length caps.
Some systems still reject spaces or cap passwords at 16 characters, forcing a shorter phrase than you intended.
Entropy assumes the full wordlist and a uniform draw; a filtered or shortened list lowers the real figure.
Memorability is a human property the tool cannot measure — a phrase you forget is a phrase that failed.

Frequently asked questions

How many words do I need?: Six words from a 7,776-word list gives roughly 77 bits, which is comfortably beyond offline cracking. Five gives about 64 bits — fine for most accounts, marginal for a master password.
Is a passphrase stronger than a random password?: Per character, no; per unit of human memory, yes. A 20-character random string beats a five-word phrase on entropy but cannot be memorised or dictated reliably.
Does capitalising or adding a number help?: Barely — a couple of bits at most, while measurably hurting memorability. Add another word instead: that is 12.9 bits.
Is the phrase generated privately?: The word draw uses a cryptographically secure random source. Treat any generated secret as compromised if you leave it on screen or in a clipboard history you do not control.

Related tools

Password Generator Password Strength