About the Handiwork Passphrase Generator
The Passphrase Generator builds memorable passwords from independently selected random words. Choose how many words to use, pick a separator, and optionally capitalize words or add a random number. The search-space estimate is calculated from the actual word-list size and selections. Everything is generated locally with the Web Crypto API, so the generated phrase is not sent to Handiwork.
How to use the Handiwork Passphrase Generator
- Pick a preset (Memorable, Strong, Simple, or Shorter) or set the number of words with the slider.
- Choose a separator and toggle capitalization and a random number to suit the site’s rules.
- Check the entropy and strength meter, then copy your passphrase. Use the refresh button for a new one.
Why random words can be easier to use
Length is the most important factor in password strength, and several unrelated words can be easier to remember and type than a shorter jumble of symbols. The words must be selected randomly, not arranged into a quote, lyric, personal fact, or familiar phrase. Human-chosen phrases are far more predictable than the generated search-space estimate assumes.
How many words should I use?
Each independent pick from the 739-word list adds about 9.5 bits to the generated search space. The default uses six words; adding a seventh or eighth expands that space substantially. Site requirements and threat models differ, so treat the meter as a transparent mathematical estimate rather than a guarantee that a particular account cannot be compromised.
Separators, capitals, and numbers
Separators make a passphrase easier to read and can satisfy sites that require special characters. Capitalization in this tool is deterministic, so it does not add entropy. The optional digit and its randomly chosen position do add a small amount, but the bulk of the search space still comes from independently selected words.
Generated privately in your browser
Passphrases are created with the Web Crypto API’s secure random generator and never sent anywhere. Only your option preferences are saved locally for convenience. When you are done, store the passphrase in a reputable password manager and use a unique one for every account.
Continue this workflow
Use the adjacent tool when the next step calls for a different input, output, or method.
Assumptions and limitations
- The estimate assumes every generated word remains unchanged and was selected independently. Reordering words into a familiar phrase or replacing them with personal choices invalidates that estimate.
- Some websites limit spaces or password length. Confirm the destination accepts the generated phrase before relying on it.
- Use a unique passphrase per account and store it in a reputable password manager. Do not treat a strength label as a substitute for multi-factor authentication or breach monitoring.
Sources and standards
These authoritative references were used to verify the method and guidance on this page.
Frequently asked questions
Is this a random word password generator?
Yes. It builds a password by selecting words independently at random from a 739-word list. Choose the word count and separator, then copy the generated passphrase. Choosing a favorite quote or inventing your own sequence of words does not provide the same random selection.
What is a passphrase?
A passphrase is a password made from several words. When each word is selected independently at random, the result can combine substantial length with better memorability than a short symbol-heavy password.
Are passphrases actually secure?
They can be strong when enough words are independently selected at random and the phrase is unique. The meter reports the mathematical generated search space; it cannot account for reuse, phishing, malware, server breaches, or a phrase edited into a predictable pattern.
Is this passphrase generator private?
Generation happens locally in your browser using the Web Crypto API. Handiwork does not transmit or intentionally store the generated phrase; only option preferences are saved on your device. As with any web app, use a password manager for long-term storage.
How many words should my passphrase have?
The default uses six words from this tool’s 739-word list. Add more words for a wider search space, especially for a high-value login. Always follow the destination service’s rules and your organization’s security guidance.
Should I add numbers or capital letters?
They can satisfy composition rules. The optional digit and its random position add a small amount to the search space; automatic first-letter capitalization is predictable and adds none. Adding another random word has a much larger effect.