Open the Vootkit workspace.
01Privacy toolTool result
Passphrase Generator
Memorable word-based passwords from a secure RNG.
100% FreeRuns instantlyNo watermark
- 1Choose toolOpen the Vootkit workspace.
- 2Add inputProvide the content or settings.
- 3ProcessLet the browser do the work.
Private by designProcessed on your device where possible.
Works on any deviceDesktop, tablet and mobile browsers.
No installationOpen the page and start working.
Always free coreUse the free plan for everyday tasks.
How to use Passphrase Generator
Provide the content or settings.
02Let the browser do the work.
03Copy, download or continue.
04Your files stay private
Your work is processed locally in your browser where possible and is never added to a Vootkit upload library.
Learn more about privacyA random passphrase of ordinary words beats a short mangled password on both counts that matter: it is stronger, and you can actually remember it. The strength comes from the number of possible combinations, not from looking complicated.
What Passphrase Generator does
Draws words at random from a 564-word list, which gives 9.14 bits of entropy per word. Four words is about 37 bits, five is 46, six is 55 — each extra word multiplies the search space by 564.
Selection uses the browser’s cryptographic random source with rejection sampling, so the draw is genuinely uniform rather than subtly biased toward the start of the list.
Entropy by length
| Wordlist | 564 words |
|---|---|
| Per word | 9.14 bits |
| 4 words | ≈ 37 bits |
| 5 words | ≈ 46 bits |
| 6 words | ≈ 55 bits |
| 7 words | ≈ 64 bits |
| Randomness | crypto.getRandomValues, unbiased |
| Runs | On your device — nothing generated server-side |
Detailed steps
- Choose the number of words — five or six for anything important.
- Add a separator, capitalisation or a number if a site demands them.
- Store it in a password manager rather than trusting memory alone.
Worth knowing
Use the passphrase as generated. Substituting characters — a for @, o for 0 — adds almost no real strength because every cracking tool tries those substitutions first, and it destroys the memorability that was the whole point. If you need more strength, add a word: that multiplies the difficulty by 564.
Frequently Asked Questions
How many words do I need?
Five gives about 46 bits and is fine for most accounts; six gives 55 and suits anything valuable. Four at 37 bits is acceptable only where the account matters little. Each extra word multiplies the possibilities by 564.
Is a passphrase really stronger than a complex password?
For the same memorability, comfortably. "Tr0ub4dor&3" is short enough to be searched despite looking complicated; five random words is a far larger space and you can recall it. Length beats character variety once the choice is genuinely random.
Should I substitute characters?
No. Cracking software tries those substitutions as standard, so the added strength is negligible while the memorability loss is total. Add a word instead.
Is the randomness trustworthy?
It uses the browser’s cryptographic random generator with rejection sampling to avoid modulo bias — so every word is equally likely. A naive implementation would favour the earlier words slightly, which reduces real entropy.
Is Passphrase Generator free?
Yes. The Vootkit free plan includes 5 tool runs a day. Upgrade to Vootkit Pro for unlimited daily use, an ad-free workspace and saved workflows.
Are my files uploaded?
No. Passphrase Generator runs entirely in your browser — your file is processed on your own device and never sent to a server. There is nothing for us to store or delete.
Do I need to install anything?
No. Passphrase Generator works in any modern browser on desktop, tablet or phone. Open the page and start.
How often can I use it? Is there a daily limit?
On the free plan you get 5 tool runs a day. When you reach the limit you'll see a prompt to upgrade, and it resets the next day. Vootkit Pro removes the cap entirely for unlimited daily use.
Recently viewed
This tool processes everything locally in your browser. You can disconnect from the internet after the page loads and it will still work.