Generate memorable yet secure passphrases — easier to remember than random passwords
"correct-horse-battery-staple" is both memorable AND more secure than a typical 8-character random password. The randomness of word selection — not the words themselves — makes it strong.
correct-horse-battery-stapleocean.forest.thunder.crystalPurple Mountain River Garden Stormflying-dragon-silver-storm-42| Property | Random 8 chars | 4-word passphrase |
|---|---|---|
| Example | x9K#mP2q | correct-horse-battery-staple |
| Entropy | ~52 bits | ~51 bits (from 200 words) |
| Memorability | ❌ Very hard | ✅ Easy |
| Typing speed | Slow | Fast |
| Crack time | ~1 month | ~550 years (word-list attack) |
| Better at 6 words | — | ✅ Uncrackable in practice |
A passphrase is a sequence of 4 or more random words used as a password — for example, flying-dragon-silver-storm. Unlike traditional passwords, passphrases derive their strength from the randomness of word selection, not from character complexity. They are significantly easier to memorize while remaining cryptographically strong when generated correctly.
Both are secure when properly generated. The comparison depends on context:
When to use a passphrase: For your password manager master password, Wi-Fi password, or any password you need to type by hand. When to use a random password: For everything stored in a password manager where you never type it manually.
PassKit uses crypto.getRandomValues() to randomly select words from an embedded 200+ word list — the digital equivalent of rolling dice. Words are joined by your chosen separator (hyphen, space, dot, number, or none). A trailing number can be appended to satisfy password policies that require digits. All generation happens in your browser — no server, no transmission.
Diceware is a passphrase method invented by Arnold Reinhold in 1995. You roll five physical dice to generate a 5-digit number, then look it up in a numbered word list. The Electronic Frontier Foundation (EFF) published an improved list in 2016 with more recognizable words. PassKit.in replicates diceware's randomness digitally using the browser's CSPRNG.
correct-horse-battery-staple is famous because it's both memorable and strong — the xkcd comic by Randall Munroe popularized this concept. A 4-word passphrase from a 7,776-word list has 51 bits of entropy; a 6-word version has 77 bits.flying-dragon-silver-storm-42). This helps satisfy password policies that require digits without compromising memorability. Avoid predictably substituting letters with symbols (e.g., p@ssword) — attackers know these patterns. Random additions are fine.correct-horse-battery-staple typed manually is now famous and would appear in attacker word lists. Always use a random generator like PassKit.in — never pick words yourself. With truly random selection from a large word list, dictionary attacks fail because the attacker cannot distinguish which words were selected from millions of possible combinations.