What is a passphrase and why is it better than a password?
A passphrase is a sequence of random words used as a password — for example, "correct-horse-battery-staple". The key insight, first popularised by cryptographer Bruce Schneier and made famous by the XKCD comic strip, is that a string of random common words is both easier to remember and harder to crack than a shorter string of random characters.
Consider the difference: "Tr0ub4dor&3" might seem strong because it uses numbers and special characters, but it is only 11 characters drawn from a specific pattern a human might think of. "correct horse battery staple" uses four random words from a list of 2,000+, giving around 44 bits of entropy — orders of magnitude more combinations for a brute-force attack to work through.
Understanding entropy
Entropy measures randomness in bits. Each bit doubles the number of possible values. A 4-word passphrase drawn from a 2,048-word list has 4 × log₂(2048) = 4 × 11 = 44 bits of entropy. A 6-word passphrase reaches 66 bits. Security professionals generally recommend 60–80 bits for most use cases, and 100+ bits for high-value accounts.
How the ToolHive passphrase generator works
The generator uses the browser's cryptographically secure random number generator (window.crypto.getRandomValues) to select words from a curated list of 2,000+ common English words. This is important: the randomness is cryptographic quality, not the weaker Math.random() function used by many generators.
The word list is chosen to contain words that are common enough to be memorable but not so predictable that an attacker could enumerate them easily. All generation happens in your browser — no words are sent to any server.
Customisation options
The word count slider controls how many words to use. Three words is the minimum (around 33 bits, acceptable for low-value use), while eight words gives excellent security. The separator controls what goes between words — hyphens are readable and still URL-safe, spaces are easiest to type but some systems reject them, and no separator produces a compact string.
Capitalising the first letter of each word improves readability slightly and may satisfy password policies that require uppercase letters. Appending a number satisfies numeric requirements on sites that demand them.
What the strength meter measures
The strength meter shows estimated entropy bits and crack time. The crack time assumes a sophisticated attacker can try one billion passphrase guesses per second — this is the rate achievable by modern GPU-based cracking rigs on offline attacks. Online attacks against live websites are far slower due to rate limiting, so even a 3-word passphrase is practically secure against web login attacks. The offline crack time matters for hashed passwords in a database breach scenario.
Generating passphrases in bulk
The bulk generation buttons let you create 5, 10, or 20 passphrases at once. This is useful when you need to generate multiple temporary access credentials, test accounts, or when you want to pick your favourite from a list rather than accepting the first result.
Best practices for using passphrases
Use a unique passphrase for every account — never reuse. Store them in a password manager so you only need to remember the master passphrase. Use 4 words minimum for email and social accounts, 5–6 words for financial accounts and password manager master passwords, and 7+ words for anything where a breach would be catastrophic.