Passphrase Generator (Diceware), Explained
After reading this you will know how diceware turns dice rolls into memorable passphrases, how to count the entropy in bits, and how to pick a length that resists a real attacker.
What diceware is
Diceware is a method for generating passphrases by picking whole words at random from a fixed list. You roll five dice, read the five digits as a number, and look that number up in a wordlist. Repeat until you have enough words. The result is something like trombone rehab framework voucher dockyard: easy to picture and type, hard to guess.
This tool uses the EFF long wordlist, which has exactly 7,776 words. That number is not arbitrary. Five six-sided dice produce 6^5 = 7776 equally likely outcomes, so every word maps to one dice combination and every combination maps to one word. Each word you add is one fresh, independent draw from those 7,776 options.
The strength comes entirely from that random selection, not from keeping the list secret. An attacker can download the same wordlist. What they cannot do is shortcut the number of guesses required, and that number is what you control.
When to use it, and when not
Use a diceware passphrase when a human has to remember and type the secret: a laptop login, a password manager master password, a disk encryption key, an SSH key passphrase. These are the credentials you cannot store in another vault, so memorability matters.
For everything else, prefer a long random string from a machine, because you are not going to memorize 200 of them. Store those in a manager. A generated string of random characters packs more entropy per character than words do, so if you never type it by hand, use the Password Generator instead.
Never invent your own "random" words in your head. People reach for names, dates and common nouns, and the effective pool collapses from 7,776 to a few hundred. The entropy math below only holds when the choice is made by real dice or a cryptographic random number generator, not by a person trying to feel random.
The entropy formula
Entropy measures how many guesses an attacker needs, expressed as a power of two. For a passphrase built from n independent words drawn from a list of size N, the entropy in bits is:
Here H is the entropy in bits, n is the number of words, and N is the wordlist size. Each symbol is exact. With the EFF list, N = 7776, so one word contributes:
That is where the figure of 12.9 bits per word comes from. It is just the number of bits in five dice rolls. The total entropy is the per-word value times the count, because the draws are independent: a passphrase of 5 words carries 5 \times 12.9 = 64.6 bits.
Bits translate into a guess count directly. A secret with H bits has 2^H equally likely values. On average an attacker finds it after trying half of them, so 2^{H-1} guesses.
Worked example: reproducing the demo
A five word passphrase
The demo generates five words from the EFF long list. Suppose the dice rolls come out as below. Each row is five dice, read left to right, then looked up in the list.
| Word # | Dice | Word | Bits added | Running total |
|---|---|---|---|---|
| 1 | 4 3 6 5 1 | trombone | 12.9 | 12.9 |
| 2 | 5 1 2 6 3 | rehab | 12.9 | 25.8 |
| 3 | 2 6 1 4 4 | framework | 12.9 | 38.8 |
| 4 | 6 2 5 3 1 | voucher | 12.9 | 51.7 |
| 5 | 1 5 3 6 2 | dockyard | 12.9 | 64.6 |
- Count the possibilities: 7776^5 \approx 2.8 \times 10^{19}.
- Convert to bits: \log_2 (2.8 \times 10^{19}) \approx 64.6.
- Average guesses to crack: 2^{63.6} \approx 1.4 \times 10^{19}.
The passphrase trombone rehab framework voucher dockyard is 40 characters including spaces, yet you only had to remember five words. That is the tradeoff diceware makes: more characters, fewer independent choices, and choices are what count.
How length changes the numbers
Entropy grows linearly with word count, but the guess count grows exponentially. Adding one word multiplies the search space by 7,776. The table shows the jump.
| Words | Bits | Possibilities |
|---|---|---|
| 4 | 51.7 | 3.7 × 10¹⁵ |
| 5 | 64.6 | 2.8 × 10¹⁹ |
| 6 | 77.5 | 2.2 × 10²³ |
| 7 | 90.5 | 1.7 × 10²⁷ |
| 8 | 103.4 | 1.3 × 10³¹ |
Reading and interpreting the result
The tool reports entropy in bits alongside the words and the dice rolls that would produce them. Read the bits, not the character count. A 40-character passphrase of five common words has 64.6 bits; a 40-character string that is actually a sentence from a book has far less, because sentences are predictable.
Use these rough thresholds. Below 50 bits, a well-funded attacker can crack it offline. Around 64 bits (5 words) is fine for accounts protected by rate limiting and for most personal use. Around 77 bits (6 words) is the sensible floor for a password manager master password or full-disk encryption, where the attacker gets the file and can grind offline forever.
A 5-word passphrase at 64.6 bits beats a random 8-character password at about 52 bits, and you can actually recall it. Length in words buys you both memorability and margin.
Common mistakes
- Substituting letters
- Turning
voucherintov0uch3radds almost nothing. Attackers apply those swaps automatically. The entropy stays near 12.9 bits for that word. - Reordering words yourself
- Shuffling the words after generation feels clever but adds at most \log_2 (5!) \approx 6.9 bits, and only if the attacker does not know you did it. Add a word instead: that is 12.9 bits, guaranteed.
- Dropping words to fit a length rule
- Trimming from 6 words to 4 to satisfy a "max 20 characters" field cuts entropy from 77.5 to 51.7 bits, a factor of about 67 million in guess count. Pick a service that allows long passphrases.
- Reusing one passphrase everywhere
- Entropy protects one secret against guessing. It does nothing once that secret leaks from a breached site. Use a unique passphrase per high-value account.
Related tools
When the secret lives only in a manager and never gets typed, generate a dense random string with the Password Generator, which shows the same entropy figure in bits. To audit a password or passphrase you already have, the Password Strength Checker estimates its entropy, flags predictable patterns, and gives crack-time ranges.
Frequently asked questions
Does knowing the wordlist help the attacker?
No. The list is public, and the security assumes it is. With 5 words the attacker still faces 7776^5 \approx 2.8 \times 10^{19} equally likely combinations. Knowing the words does not tell them which combination you drew.
How many words should I use?
Five words (64.6 bits) for typical accounts, six words (77.5 bits) for a password manager master password or disk encryption. Add words rather than symbols when you need more strength.
Are the spaces part of the passphrase?
Use them if the service allows it, since they make the phrase readable and cost nothing. If spaces are rejected, join the words directly. The entropy is unchanged either way because it comes from the word choices, not the separators.
Is a passphrase weaker because it is made of real words?
No, as long as the words were chosen at random. The attacker cannot exploit the fact that trombone is a real word, because you could equally have drawn any of the other 7,775 words. Randomness in the selection is what matters.
Can I use fewer words if I add numbers and symbols?
You can, but the math rarely favors it. One extra word adds 12.9 bits. Appending a single random digit adds about 3.3 bits, and appending a symbol from a set of 30 adds about 4.9 bits. Adding a word is the cheaper way to buy strength you will remember.
Related tools
Password Generator
Strong random passwords with the entropy shown in bits.
Password Strength Checker
Entropy estimate, pattern warnings and crack times.
Are You Random? — The Oracle
Press left or right at random. The machine predicts your next press — and wins.
Dice Probability Lab
Exact odds for any dice expression — 4d6kh3, 2d20kh1…
Dice Roller (RPG Notation)
Roll 3d6+2, d20, 4d6 keep highest 3 — with statistics.
Random Color & Palette Generator
Random colors and harmonious palettes with hex codes.