Tr7$mK9!qL2 is a technically strong password and practically impossible to remember without writing it down. horse-lamp-eleven-garden-fire is just as strong (or stronger) and can be memorized in a couple of tries. The difference is the Diceware method: instead of generating random characters, it generates random words from a predefined list.
Why entropy doesn't depend on character type, but on possible combinations
A password's strength is measured in entropy: how many distinct combinations are possible. A random-character password gains entropy by adding symbols and uppercase letters; a Diceware passphrase gains the same entropy (or more) simply by adding another word from the list.
The math is simple: if the list has 7,776 possible words (the Diceware standard, chosen because it's exactly 6⁵, the number of combinations from 5 rolls of a 6-sided die), each added word multiplies the possible combinations by 7,776. With 5 words, you already comfortably surpass the entropy of a random 12-14 character password with symbols.
Why it's easier to remember without being weaker
The human brain remembers concepts, not arbitrary sequences of symbols. M7#kL9$pQ2! means nothing, so memorizing it requires mechanical repetition. elephant-triangle-thursday-ocean are four concrete concepts that are far easier to visualize and chain together mentally, even though mathematically they're just as "random" as the first option.
How to generate a Diceware passphrase
- Choose how many words you want in the passphrase (more words = more entropy; 5-6 is a solid starting point for most uses).
- The tool selects words at random using
crypto.getRandomValues, the browser's cryptographically secure generator. - Copy the generated passphrase, or generate again if you want a different combination.
You can do it free with the Diceware passphrase generator on this site.
Why the random number generator matters as much as the words
If words are chosen with a predictable pseudo-random number generator (like JavaScript's Math.random(), which isn't meant for cryptographic use), an attacker with enough information could, in theory, predict or narrow down the possible combinations. Using crypto.getRandomValues(), the browser's cryptographic API specifically designed to generate unpredictable values, is what guarantees the word selection is truly random in the cryptographic sense, not just in appearance.
When to use Diceware instead of a regular password generator
- For a password manager's master password: this is exactly the case where you'll be typing it from memory repeatedly, so memorability matters as much as strength.
- For passwords you share verbally (over the phone, dictating to someone): a passphrase is dictated and understood unambiguously; a string of random symbols is a nightmare to spell out.
- For any case where you'll need to remember it yourself, without relying on a manager.
For every other password (the ones a manager remembers for you), a traditional random password generator is still the more practical choice, because you never need to memorize them.
Frequently asked questions
How many words do I need to be truly secure? 5-6 words already exceed the entropy of most common password requirements; for maximum security, 7-8 words.
Is Diceware more secure than a random character password? At equal entropy, it's not mathematically "more" secure, but it is more practical because it can be remembered without writing it down, reducing the risk of reuse out of convenience.
Can I add symbols or numbers to my Diceware passphrase? Yes, though it's not strictly necessary if you already use enough words; some services require symbols by policy, in which case you can add one without compromising memorability.
Is the passphrase generated in my browser or on a server? In your browser, using the browser's own cryptographic API; the passphrase is never sent to any server.
Generate secure, memorable passphrases free with the Diceware generator, using crypto.getRandomValues and 100% in your browser.