How Diceware Turned Random Words into Strong Passphrases

A long passphrase does not become strong merely because it contains many letters and spaces. People choose quotations, lyrics, and appealing sentences according to familiar patterns, and attackers can incorporate those patterns into their guessing dictionaries. Diceware derives its strength from something else: the words are selected by a source of randomness, so an attacker must search the full space of possible combinations.

This idea predates the four words that became an internet meme through an XKCD comic. In the mid-1990s, Arnold Reinhold proposed using ordinary dice as a transparent source of randomness that did not depend on a computer. The method became known as Diceware, connecting a simple physical procedure to a measurable amount of uncertainty.

How five rolls become one word

The classic Diceware list has exactly 7,776 entries because five rolls of a six-sided die produce that many sequences: 6⁵ = 7,776. You write the results in order, such as 43463, look up that row in the list, and receive one word. Another five rolls select the next word, and the process continues until the passphrase reaches the desired length.

It is important not to choose the most appealing result from several attempts or reroll because a combination looks odd. Repeated words are valid as well. Every choice needs to remain independent and uniform; otherwise, the actual set of possibilities shrinks and the familiar entropy calculation no longer describes the resulting phrase.

For a wordlist of size W and a phrase containing n independently selected words, the entropy is:

H = n × log₂(W)

When W = 7,776, one word contributes about 12.9 bits, five words provide roughly 64.6 bits, and six provide about 77.5 bits. This is not a timer promising a particular number of years before a password is cracked. Guessing speed depends on whether a service limits attempts, how it hashes passwords, and whether an attacker has obtained a database for offline cracking. Entropy describes the number of equally likely candidates before those conditions enter the calculation.

What XKCD 936 changed

In 2011, Randall Munroe published XKCD #936, “Password Strength”, comparing Tr0ub4dor&3 with correct horse battery staple. The first password looks complicated, but it is built from a familiar word, a common letter-to-digit substitution, and a predictable suffix. The second is easier to picture and remember, while its words are independently selected in the comic's model.

The comic's estimates of 28 and 44 bits are often repeated as if they were ready-made measurements, although they only make sense under Munroe's assumptions about how each password was created. Four words selected uniformly from the complete Diceware list would yield about 51.7 bits, but the same number cannot be assigned to a four-word sentence composed by a person. The comic's famous phrase itself has also been in password-cracking dictionaries for years and should never be treated as a secret.

XKCD's main contribution was not a new formula but a memorable explanation of the tradeoff between strength and memorability. It showed a broad audience why visual complexity is not the same thing as randomness at the point of creation.

Why EFF published a new list

Reinhold's original list favored short entries, so it included abbreviations and character sequences that were not always easy to pronounce. In 2016, the Electronic Frontier Foundation published a long list of 7,776 more recognizable English words. The size of the space stayed the same, so each random word retained the same 12.9 bits of entropy, but the resulting phrases became easier to read and memorize.

EFF recommends six random words for most purposes and specifically warns against reusing the resulting phrase across websites. A password manager is more practical for generating unique credentials for ordinary accounts. Diceware is most useful when one secret genuinely needs to be remembered, such as a password manager's master password, a disk encryption password, or the passphrase that unlocks a private key.

Current NIST guidance supports the broad principle without declaring every phrase secure. SP 800-63B-4 tells services to permit long passwords, spaces, and pasting from password managers, while checking new passwords against a blocklist of common or compromised values. It also rejects mandatory composition rules such as requiring one uppercase letter, one digit, and one special character because people satisfy them in predictable ways. Length helps, but the selection process remains decisive.

Why BIP39 is a different system

A set of 12 or 24 wallet words may look like Diceware, but it solves another problem. A BIP39 mnemonic encodes 128 to 256 bits of computer-generated entropy plus a checksum, then splits that data into indices for a 2,048-word list. It is not a password sentence that should be invented or assembled in a general passphrase generator.

BIP39 also defines an input called a passphrase, but it is supplied to the seed derivation function separately from the mnemonic. A Diceware phrase can therefore serve as an additional secret for a compatible wallet when used carefully, but it cannot replace the recovery words.

How the generator on this site works

The Passphrase Generator offers four wordlists. EFF's modern English list is the default, while the original Diceware list, the alternative Beale list, and a Russian Diceware list are also available. Each file contains 7,776 unique words, so uniform selection provides the same 12.9 bits per word in every case. The choice changes the language, vocabulary, and memorability of the result, but not the size of the combination space.

Every word is selected independently with crypto.getRandomValues. The generator preserves a uniform distribution through rejection sampling, discarding values that would introduce a slight modulo bias when mapped to a wordlist index. It also verifies that a loaded file contains exactly 7,776 unique words, so an incomplete or damaged list is not used for generation.

The tool offers 6, 12, 15, 18, or 24 words, several case styles, and spaces, hyphens, underscores, or a custom separator. Case and separator choices contribute no entropy because the user sets them and an attacker can assume them. The optional random digit suffix adds log₂(10), or approximately 3.32 bits.

The meter reports the calculation for uniform selection from the complete list, while labels such as “Strong” are reference points rather than guarantees. Generation happens locally in the browser, and the tool does not send the resulting phrase to a server. A high-value secret should still be created on a trusted device, kept out of clipboard history, and left unchanged even when one of the random words feels inconvenient; manual improvements can quietly undo the benefit of random selection.

Related tools

Passphrase GeneratorGenerate passphrases from the official 7,776-word EFF long list with adjustable word count, separator and capitalization, plus an entropy meter.Password GeneratorGenerate strong passwords with a cryptographically secure generator, adjustable character sets, an entropy strength meter, and batch output.Shamir's Secret SharingSplit a secret into N shares with a K-of-N threshold and recover it from any K. Shares export as text or QR codes and a ZIP archive, all client-side over GF(256).