XKCD password generator
This makes passphrases the way xkcd comic 936 describes: common words picked at random and strung together, like "correct horse battery staple". It starts at four words from EFF's 7,776-word list, and each word adds about 12.9 bits.
Free, no sign-up. Runs in your browser. Nothing you type or upload is sent to us or stored.
At a glance
- The comic's maths
- Four random common words from a 2,048-word list: 4 × log2(2,048) = 4 × 11 = 44 bits
- Source: xkcd.com, checked 2026-11
- Wordlist used here
- EFF's long wordlist: 7,776 words (6⁵), so log2(7,776) ≈ 12.92 bits per word
- Source: eff.org, checked 2026-11
- Bits by number of words
- 4 words ≈ 51.7 bits · 5 ≈ 64.6 · 6 ≈ 77.5 · 7 ≈ 90.5 (words × 12.92)
- EFF's advice
- Six words from the long list for most uses, about 77 bits
- Source: eff.org, checked 2026-11
- Shortest possible four-word phrase
- 15 characters with spaces (the shortest words have 3 letters), which meets NIST's 15-character minimum for a password used on its own
- Source: pages.nist.gov, checked 2026-11
Keep a page for the right people only
On Liite Pro you can protect a page with a password, so a client area, a price list or a guest page is only seen by people you give it to.
XKCD password generator: what to know
This page starts the password generator for this case. For every option and how to use it, see the password generator.
Why the words have to be picked at random
The comic's numbers assume the attacker knows exactly how you made the passphrase: which list, how many words. The strength comes only from the random picks. Every word is one of 7,776 equally likely choices, so four words give 7,776⁴ possible phrases, about 2⁵¹·⁷.
Words you choose yourself don't count the same way. People pick song lyrics, quotes and words that go together, and attackers try those first. Let the generator pick, then keep the phrase even if it reads oddly. Odd is what you want.
Four words or more?
Four words give about 52 bits (the meter shows 51, Fair). That's fine for an account with two-factor authentication and a login limit. For anything that protects other accounts, such as your email or your password manager, use six words or more. Each extra word multiplies the work by 7,776.
Capital letters and a number at the end add little. Capitalising every word adds nothing, because an attacker can try that pattern at once; a random digit adds about 3.3 bits, a quarter of a word. Turn them on only when a site insists.
Questions
Is xkcd's password strength right?
The maths holds for words picked truly at random: four words from a 2,048-word list give 44 bits, as the comic says. It doesn't hold for words you choose yourself, which are far easier to guess.
What is the 8 4 rule for passwords?
An informal rule: at least 8 characters using all 4 kinds (upper case, lower case, digits, symbols). NIST no longer recommends composition rules like this and asks for 15 characters for a password used on its own.
How is this different from the NCSC's three random words?
It's the same idea. The NCSC suggests three random words so a password is long enough and easy to remember. A generator makes the words truly random, and adding a fourth or fifth word makes it much stronger.