XKCD-Style Passphrase Generator
Generate xkcd-style passphrases from random common words with your choice of separator, capitalization and word length. Entropy is shown in bits.
Loading dictionaries…
What is XKCD Password Generator?
Inspired by xkcd comic #936, this generator strings together randomly chosen words, like correct-horse-battery-staple, to make passwords that are long, strong and easy to remember. You control the number of words, the separator, capitalization and word length.
How to use XKCD Password Generator
- Set the Number of words (2–12); 4 matches the comic, 5–6 is better today.
- Choose a Separator and Capitalization style.
- Adjust Minimum/Maximum word length and optionally Add a random digit at the end.
- Click Regenerate; several candidates are shown, copy the one you like.
Example
4 words, hyphen separator, Capitalize Each Word, add a digit
Acuteness-Slug-Obsolete-Renegade1 (55.0 bits)
Random output; yours will differ.
When to use XKCD Password Generator
Use it for passwords you type regularly: computer logins, Wi-Fi keys you share verbally, master passwords. Choose at least 5 words for anything an attacker could attack offline. Avoid it for systems with short maximum password lengths; use the character generator there.
How XKCD Password Generator works
Words are drawn uniformly with crypto.getRandomValues from the EFF large wordlist filtered by your length range. Entropy = words × log2(pool size), plus 1 bit per word for random capitalization, log2(10) per random-digit separator and log2(10) for an appended digit. The figure assumes the attacker knows the wordlist and your settings, so it is an honest lower bound. Picking one of several shown candidates costs at most log2(count) bits.
Common Use Cases
- Creating a memorable computer login password
- Generating a Wi-Fi password that is easy to read aloud
- Making a password-manager master password
- Producing passphrases for teaching password security
Security Note
Do not edit the generated phrase into something more 'meaningful'; human choices make it predictable.
FAQs
Is correct horse battery staple still secure?
That exact phrase is now in every cracking dictionary. The idea is sound: four truly random words from 7,776 give 51.7 bits; use five or six words for strong protection.
Why does capitalization add so little?
Capitalizing every word in the same way is a rule the attacker knows, so it adds nothing. Only random capitalization per word adds 1 bit per word.
Which word list is used?
The EFF large wordlist of 7,776 common English words, filtered by the minimum and maximum length you choose.