Why words instead of characters
A passphrase and a random password are the same idea in different units. Both draw independently from a fixed set of options; the only difference is whether an option is a character or a whole word. A character drawn from the 94 printable ASCII values carries about 6.55 bits. A word drawn from a list of nine hundred carries about 9.8, and a word drawn from a Diceware-style list of 7,776 carries 12.9. So one word replaces roughly two random characters and is enormously easier to read off a screen and type into a games console, a smart television or a phone keyboard.
The catch is length in characters. A five-word passphrase from this list is around 30 characters, and some login forms still cap the field at 16 or 20. When the cap bites, the passphrase loses and you fall back to characters. That is a property of the site, not of the method.
Where the entropy number comes from, and what it does not cover
Entropy here is log2(list size) multiplied by the number of words, plus a few bits for an appended digit or symbol if you asked for one. That formula is only meaningful because of how the words were chosen: independently, uniformly, from a list whose size is known and published. Every one of those conditions is doing work.
Independence means the second word does not depend on the first, so no dictionary of common phrases helps an attacker. Uniformity means no word is more likely than another, which is what the rejection sampling below is for. A known list size means the attacker is assumed to have the list, which is the correct assumption — Kerckhoffs's principle, and the reason nobody quotes a bigger number by pretending the wordlist is a secret. Nothing here is weakened by the list being public. What breaks the number is a human touching the output afterwards.
Modulo bias, and why a fair-looking shortcut is not fair
The obvious way to pick one of 700 words from a random 32-bit number is to take the remainder after dividing by 700. It is also wrong. 2^32 is not a multiple of 700, so the leftover values at the top of the range wrap around and land on the first few words, which come out slightly more often than the rest. With a 700-word list the skew is tiny — under one part in six million — but it is measurable, it is free to remove, and a generator that tolerates a bias it could have eliminated is a generator you should not trust with the next thing.
The fix is rejection sampling. Work out the largest whole multiple of 700 that fits under 2^32, and any draw at or above that number is discarded and redrawn. The loop is unbounded in theory and finishes almost immediately in practice, because the discard rate is the size of the leftover slice. Every word then has exactly the same probability, and the entropy figure printed next to your passphrase is the real one.
The list is fixed, small and deliberate
This list holds roughly nine hundred concrete English nouns. Words are three to ten letters, spelled the way an English speaker would guess, with no homophone pairs that fall apart when the phrase is read aloud over a phone. That last constraint is the reason a passphrase is worth generating at all: it exists to be remembered and dictated, and a list stuffed with obscure words to inflate the bit count defeats its own purpose.
A larger list gives more bits per word — that is the trade a Diceware list of 7,776 makes, at 12.9 bits a word against roughly 9.8 here. The tool reports the real size of the list it used rather than a marketing figure, so if you want a target number of bits you can read the word count straight off it. Adding one more word to the phrase is the cheapest way to buy bits on this page, and it costs about seven keystrokes.
What to do with the result
Generate, then paste straight into a password manager rather than into a note or a chat window to yourself. The one passphrase genuinely worth memorising is the one that unlocks the manager, because every other password can then be long, random, unique and never typed by hand. Unique per site is the property that actually stops the common failure — a password exposed in one breach being tried everywhere else — and no amount of entropy in a reused password substitutes for it. The password manager guide covers the setup, and the random word generator is the tool to reach for when you want words for something other than a credential.
Questions people ask
How many words should I use?
This page will not tell you a number, because that answer depends on what the passphrase protects, what an attacker gains by breaking it, and how the site stores it — none of which a generator can see. What it will do is print the entropy for the settings you chose, and show you what the same bit count would cost in random characters. Adding one word is the cheapest way to add bits: each extra word is worth close to ten bits here, whatever the current length.
Can I swap a word I do not like?
You can, and doing so invalidates the entropy figure. The number is a statement about the process — independent uniform draws from a known list — and a word you chose by hand was not drawn that way. The same applies to pressing Generate repeatedly until a phrase reads nicely, which quietly filters the output through your taste and narrows the space an attacker has to search. If a draw is unusable, take the whole next one rather than editing this one.
Are the separator and the appended digit worth anything?
The separator is worth nothing in bits, because it is fixed and an attacker knows it. It is worth something in practice: hyphens or spaces keep the word boundaries visible when you read the phrase back, and running the words together creates accidental readings that make dictation harder. The appended digit adds log2(10), about 3.3 bits, and a symbol from the thirteen offered adds about 3.7 — both are counted honestly in the total and both are worth less than half a word.
Why does the tool refuse to call anything strong?
Because "strong" is a threshold, thresholds depend on the attacker and on how the site hashes what you send it, and any specific claim would be out of date or wrong for somebody. The entropy in bits is a fact about the generator and it travels: you can compare it against another passphrase, against a character password in the table, or against whatever figure a policy you have to satisfy actually names. Interpreting it is a decision, not a calculation.
Is it safe to generate a passphrase in a browser?
Nothing is uploaded — no network request is made, and you can confirm that in the network tab of your developer tools. The remaining risk is the machine itself: a device with malware, a shared browser profile, or a screen someone else can see gives the passphrase away regardless of how it was generated. Generate on a device you control, paste the result into a password manager rather than retyping it, and treat any passphrase you have typed into a page you did not write as one you should not already be using elsewhere.