Diceware Passphrase Generator — Random Word Passphrases

This tool generates passphrases the Diceware way: instead of a dense string of random characters that is hard to type and even harder to remember, it strings together several ordinary words picked independently at random. A passphrase like "forest-comet-lantern-guitar-oasis-thistle" carries real, calculable entropy while still being something a human being can read out loud, type on a phone keyboard, or memorize after a few tries — which is exactly the trade-off Diceware-style generation was designed around.

Randomness is the entire point, so it is taken seriously here: each word is chosen using the browser's crypto.getRandomValues() cryptographically secure random number generator, with proper rejection sampling on every draw. A raw 32-bit random value is only accepted if it falls in a range evenly divisible by the wordlist length; values in the leftover, uneven remainder are discarded and re-rolled. Skipping this step and just doing value % wordlistLength would very slightly favor low-indexed words over high-indexed ones — a subtle statistical bias that a naive implementation would introduce silently. This generator never takes that shortcut.

Honesty about entropy is the other half of the design. The bundled wordlist has 1,821 unique, unambiguous, everyday English words — a large, representative list, but not the specific 7,776-word list used by the classic Diceware project, so this tool never claims the famous 12.9-bits-per-word figure that only applies to that exact list. Instead, the per-word entropy is calculated live as log2(list length), which comes out to roughly 10.8 bits per word here, and the on-screen result always shows the full formula — word count times bits-per-word, plus the honest contribution of any extras — so you can see exactly how the total was reached rather than trusting a marketing number.

The optional toggles are treated with the same honesty. Capitalizing every word is a fixed, deterministic rule applied the same way every time, so it adds no real entropy at all — an attacker who knows the rule gains nothing from not knowing which letters are capitalized, and the tool says so plainly. Appending a random two-digit number, by contrast, is a genuine extra random draw across 100 equally likely values, adding a real and stated ~6.6 bits on top of the words. Everything computes and renders locally in your browser with no server involved, so the passphrase you generate is never seen by anyone but you.