Why random words beat clever passwords
People are poor at choosing randomly: a phrase you invent, a song lyric or a quote is far easier to guess than it feels. A passphrase is strong only because each word is drawn by chance from a known list. The attacker may know the list and the rules and still has to try 7,776 options for every word. Six words give about 2.2 × 10²³ combinations, more than an attacker can try, and you can still picture them as a small, silly story to help you remember.
How the strength in bits is worked out
The tool counts entropy the honest way, as if the attacker already knows you used this page and these settings. Each word from the list is worth log2(7,776), about 12.9 bits. Mixed case adds one bit per word, because each word is either lower case or capitalised at random. The optional digit adds about 3.3 bits for the digit itself plus a little for which word it lands on. Separators and plain lower, Title or UPPER case add nothing, since an attacker can simply try them all.
Where a passphrase works best
Use a passphrase for anything you must type from memory: the master password of a password manager, your computer or phone login, disk encryption, or a Wi-Fi network you share with family. For ordinary website accounts, a password manager filling in a long random password is just as good, and you never have to type it. Some old systems cap the length at 16 or 20 characters; in that case use the random password generator instead, since four short words would be too weak.
The word list and its licence
Words come from the EFF large wordlist, published by the Electronic Frontier Foundation in 2016 for dice-based passphrases. It holds 7,776 common English words, so five rolls of an ordinary die pick one word. It leaves out offensive and emotionally charged words and favours ones that are easy to recognise and spell. The list is used here under the Creative Commons Attribution 3.0 United States licence. It is a static file loaded once when the page opens; your choices and results are never sent back.
Related password tools
Need something else? The password generator makes fully random passwords and handles strict site rules, bulk lists and a pronounceable style.