Passphrases - entropy, length and parameter choice

How a passphrase is generated

Every word is drawn separately from a uniform distribution, using random_int(), which reads from the operating system's cryptographically secure source. The passphrase is rendered server-side, so the first suggestion appears the moment the page loads and the tool works with JavaScript disabled. The browser-side script only recalculates entropy as settings change and handles the clipboard.

Two properties of this process determine everything else. First, the draws are independent - the choice of one word does not influence the next. Second, the distribution is uniform - every word in the dictionary is equally likely. If either property failed to hold, the entropy figures quoted here would be overstated.

The dictionary

The dictionary holds 75,241 Polish word forms written exclusively with the letters a-z. The key property is not what people usually assume: diacritics are not stripped from words. Forms that require Polish diacritical marks in correct spelling are simply excluded from the dictionary rather than being flattened. So there is no jablko, because no such word exists, but there is domek, kotami and piszemy.

The practical effect is that a passphrase can be dictated over the phone exactly as it looks, and it survives systems whose UTF-8 handling is limited or broken. Nobody has to explain that "this is an a with a tail underneath".

The dictionary is split into two sets:

• Shorter set - 40,163 words of 4 to 8 characters, 6.6 characters on average, 15.2936 bits per word.
• Extended set - 75,241 words of 4 to 12 characters, 8.26 characters on average, 16.1992 bits per word.

The shorter set yields fewer bits per word but shorter, more familiar words that are easier to memorise and retype. The extended set buys just under one extra bit per word at the cost of a longer phrase. Across seven words the difference amounts to 6.3 bits, which is less than adding a single word gains you.

The entropy arithmetic

With a dictionary of N words, each drawn word contributes log2(N) bits. For k independently drawn words the entropy of the phrase is:

The optional extras add bits explicitly. A random digit appended to one randomly chosen word adds log2(10 x k) bits, and a random special character from the eight-character set !@#$%&*? adds log2(8 x k) bits. The factor k appears because both the value and the position it is inserted at are drawn at random - the attacker has to guess both.

The figure quoted describes the entropy of the generation process, that is, the attacker's uncertainty about the outcome of the draw. It does not describe how complicated the finished string looks. The model is deliberately conservative: it assumes the attacker knows the dictionary, its size, the word count, the separator and the entire algorithm. Security rests solely on the unpredictability of the draw - this is Kerckhoffs's principle applied to a password generator.

The value applies to a single phrase. Generating ten suggestions at once weakens none of them, because only one is used.

How many bits how many words give

Values taken straight from the model, with no optional extras:

The strongest configuration - 12 words from the extended set with a random digit and a special character - gives 207.88 bits.

Password length is not entropy

This is the most common error made when assessing passphrases, and language models asked to rate password strength make it too.

The length of the finished phrase in characters must not be converted into entropy using number of characters x log2(alphabet size). That formula holds only when every character was drawn independently and uniformly from the alphabet in question. A passphrase draws words, not characters - and the characters inside a word are strongly correlated with one another, because together they spell an existing word.

A worked example. The phrase adam-zosia-piec-pies-domek-kotami-piszemy is 41 characters long. A naive calculation over an alphabet of 26 letters plus the separator would give roughly 41 x log2(27), that is about 195 bits. The actual entropy of seven words from the shorter set is 107.06 bits. The gap is 88 bits, a factor of the order of 10²⁶ in the number of possible outcomes. An attacker against this scheme searches the space of words, not the space of characters.

The general rule: entropy is a property of the generation process, not a property of the string. The same sequence of characters has different entropy depending on how it came to be. A string typed by a human who "thought of something random" has far lower entropy than a machine-generated string of the same length.

Defaults and parameter ranges

By default the generator produces one passphrase of seven words separated by hyphens. Seven rather than six, for a purely numerical reason.

The reference threshold is 98.55 bits, the entropy of 15 random ASCII characters - the value NIST SP 800-63B uses for a password acting as a standalone authentication factor. Six words from the shorter set give 91.76 bits, which is below the threshold. Seven give 107.06 bits and clear it with either dictionary set. That is why the default is seven.

• Word count: 3 to 12, default 7.
• Suggestions at once: 1 to 10, default 1.
• Separator: hyphen, full stop, underscore, plus, slash or space.
• Dictionary set: shorter or extended.
• Options: initial capital, random digit, random special character.

Using the phrase, and what not to do

Do not pick a phrase because of what it means. The stated entropy describes a machine draw. As soon as a person applies their own criterion - "this one is funny", "this one paints a coherent picture", "this one is easy to remember" - they introduce predictability the model does not account for, and an attacker who knows human preferences can partially reconstruct it. Take the first phrase generated, or choose without reading.

A passphrase does not replace MFA. Entropy protects against guessing and dictionary attacks. It does not protect against phishing, session hijacking or a breach of the provider's database. Phishing-resistant multi-factor authentication is recommended - FIDO2/WebAuthn. The two mechanisms answer different threats.

One phrase per account. Reusing the same phrase across several services reduces its real security to that of the worst-protected one. Use a password manager for storage, and apply a phrase generated here as its master password - that is precisely the scenario in which strength and memorability are both needed at the same time.

Privacy of the tool

The generator sets no cookies, uses no analytics and no external CDN. Fonts are hosted locally, a deliberate GDPR compliance decision - an external font provider would see every visitor's IP address. Generated passphrases are never stored anywhere; they exist in the memory of the process handling the request and disappear with it.