Memorable Does Not Mean Predictable

Length Helps When the Choice Is Unpredictable

A long familiar quotation, a street address or a string of family names can still be guessed. A random-word pass phrase separates two jobs: independent random selection supplies uncertainty, while the words make the result easier to type and remember.

Our generator offers three to ten words from EFF’s large list, with at least 15 characters including separators. It draws whole phrases again if they are too short. More random words supply substantially more resistance to guessing; six is a stronger starting point for an important memorized secret than three. The browser uses a cryptographic random source, not a date or a predictable shuffle.

A Practical Memory Routine

1. Generate a fresh phrase on a trusted device. Do not substitute favorite words.
2. Read the words in their original order. Picture them interacting in one unusual scene.
3. Practice recalling the sequence privately, then check it against the saved version.
4. Keep a copy in a reputable credential manager. Memory should not be your only recovery plan.
5. Generate a different phrase for every account. A Wi-Fi sharing phrase should not unlock your email or vault.

Check the Destination Before You Commit

Services differ in accepted length, spaces and punctuation. Check those rules first. Do not silently cut a phrase to fit a length limit or assume the service preserves every character. Use a manager-generated credential suited to the service when random words do not fit.

The site may still label its field “password.” A pass phrase is a kind of memorized secret that goes in that field; it is not a special protocol. Passkeys are different—they use cryptographic keys instead of a reusable typed secret.

Know When to Replace It

Change a phrase when it is exposed, reused on a compromised service, shared beyond its intended audience, or when your organization requires it. Routine changes without evidence of compromise can encourage weaker choices; follow a clear security policy, not arbitrary tricks.

Never use a published example as a real credential. A phrase generated here is only as private as your device, browser and clipboard.