Passphrase Generator: Frequently Asked Questions

A password is typically a short string of mixed characters (letters, numbers, symbols). A passphrase is a sequence of random words. Passphrases are generally longer, easier to remember, and have more entropy per character of mental effort. They are considered the more secure approach for most use cases.

The generator uses window.crypto.getRandomValues(), which is the browser's cryptographically secure random number generator. This is the same quality of randomness used in professional security tools — not the weaker Math.random() function.

Yes, because the ToolHive generator runs entirely in your browser. No words are sent to any server. You can disconnect from the internet and the generator will still work — verify this by opening the page, disconnecting WiFi, then generating.

Four words provides around 44 bits of entropy, which is secure for most use cases. For high-value accounts (email, banking, password manager master key), use 5–6 words for 55–66 bits of entropy. For the most critical applications, 7+ words is ideal.

The generator uses a curated list of over 2,000 common English words — long enough for strong entropy, short enough that each word is recognisable and memorable. The list avoids offensive words, ambiguous words, and words that are confusingly similar to each other.

Yes, a passphrase makes an excellent WiFi password. A 4-word passphrase with hyphen separators is easy to read out to guests and hard for neighbours to guess. Just make sure your router uses WPA2 or WPA3 encryption.

The crack time assumes an attacker is making one billion guesses per second — realistic for an offline attack against a leaked password hash using modern GPU hardware. Online attacks are far slower due to account lockouts and rate limiting.

Either works well if stored in a password manager. If you need to memorise it (for example, if it is your password manager's master key, or your email you access from public computers), a passphrase is far better — you can actually remember it.