b2KIT

Passphrase Generator

Generate memorable passphrases from random words with customizable word count, separators, and capitalization.

Tested tool guide Tested browser tools Checked August 16, 2026

What Passphrase Generator does and how it behaves

This tool builds a passphrase by drawing a set number of random words from a built-in list and joining them with a separator you choose - hyphen, space, dot, underscore, or none - then applying whichever capitalization rule you pick, such as capitalizing every word, one random word, or leaving everything lowercase. Everything runs in the browser; nothing is sent anywhere. The part people misjudge is where the strength actually comes from: it's the word count and the size of the underlying word list, not the separator character or capitalization pattern, which are mostly cosmetic and add very little extra guessing difficulty compared to one more word.

How the result is produced

1

Word selection

Each slot in the passphrase is filled by picking one entry independently at random from the tool's word list, repeated for however many words you've set the count to. Because each pick is independent, the same word can in principle appear twice in one passphrase unless the generator specifically checks for and excludes repeats, which this profile can't confirm without inspecting the tool's behavior directly.

2

Separator and capitalization formatting

Once the words are chosen, the tool joins them using the separator you selected and applies the capitalization mode you picked. These formatting choices change how the passphrase looks and how easy it is to type, but they add only a small, roughly fixed amount to the total number of possible outputs - nowhere near as much as increasing the word count does.

Good uses

  • Picking a strong but sayable master password for a password manager that you'll need to recall and type from memory.
  • Setting a Wi-Fi router or guest network password that other people will have to type on a phone keyboard.
  • Satisfying a site's minimum-length password requirement with something easier to remember than a random string of characters and symbols.

Limits and checks

  • The tool doesn't display the size of its underlying word list or the resulting entropy in bits, so you can't judge strength from the output alone - a 4-word passphrase from a small list is far weaker than one from a list of several thousand words, and this page has no way to confirm which applies here.
  • Changing the separator or capitalization pattern feels like it adds security but barely changes the guessing space; if you want meaningfully more strength, increase the word count rather than the formatting.
  • If an attacker knows which generator and word list produced the passphrase, security rests entirely on the random choice of words, not on the format looking unpredictable.

Common questions

Does adding a number or symbol to the end make the passphrase stronger?

A little, but not much. Appending one digit or symbol only multiplies the guessing space by roughly ten to a few dozen, while adding one more word typically multiplies it by the size of the entire word list, often thousands. If you want a meaningfully stronger passphrase, add a word instead of a suffix character.

Is the randomness here good enough to trust for a real account password?

That depends on whether the generator draws from a cryptographically secure source, such as the browser's crypto.getRandomValues, rather than Math.random. That's standard practice for security-focused generators, but treat any specific claim about this tool's internals as unverified unless the site documents it.

References and verification

The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools