Question 1

What is Diceware?

Accepted Answer

Diceware is a method for generating strong memorable passphrases invented by Arnold Reinhold in 1995. The original method used five dice rolls to look up a word in a numbered list of 7,776 words (6^5 = 7776). Each word added contributes log2(7776) = 12.92 bits of entropy. A 5-word Diceware passphrase has ~64.6 bits of entropy — strong enough to resist offline brute-force from a single GPU for many years against unsalted fast hashes, and effectively uncrackable against bcrypt or Argon2. The EFF Large Wordlist used here (published in 2016) replaced the original 1995 list with 7,776 carefully curated English words — easy to spell, no profanity, no homophones, no rare technical terms.

Question 2

How many words do I need for a strong passphrase?

Accepted Answer

4 words gives ~52 bits — okay for low-value accounts. 5 words (~65 bits) is the sweet spot for most users in 2026. 6 words (~78 bits) for high-value accounts. 7+ words for master passwords protecting password managers, hardware tokens, or full-disk encryption. The math: each EFF word contributes 12.92 bits, and breaking a passphrase of N bits takes 2^(N-1) guesses on average. At 100 billion guesses per second (one modern GPU vs unsalted fast hashes), 4 words takes ~7 hours, 5 words takes ~9 years, 6 words takes ~76,000 years. Against bcrypt or Argon2 (~30K guesses/sec), even 4 words takes centuries.

Question 3

Is a passphrase stronger than a random password?

Accepted Answer

It depends on the entropy. A 5-word EFF passphrase (~65 bits) is about as strong as a 10-character random password drawing from all 94 printable ASCII characters. The advantage of a passphrase isn't strength per character — it's memorability. Humans can reliably remember 'pedal-delphine-arabia-blaring-cramp' but struggle with 'Mx7$pFv9R2eL'. For passwords stored in a password manager (where you never type or remember them), random characters are more efficient (fewer characters for the same entropy). For passwords you type — disk encryption, master passwords, anything entered on a phone keyboard — passphrases win.

Question 4

Why this wordlist specifically?

Accepted Answer

The EFF Large Wordlist (eff.org/dice) was designed in 2016 with specific selection criteria: 3-9 letters per word, easy to spell, no profanity, no rare/technical/archaic words, no offensive content, no homophones. The original 1995 Diceware list contains words like 'jdwp', '!', and '=' — fine for entropy but a nightmare to type. The EFF list is the modern standard, used by 1Password, Bitwarden, and most password managers' generators. The list is bundled directly into this page (no CDN fetch) under the Creative Commons CC BY 3.0 US license.

Question 5

Should I add numbers or symbols?

Accepted Answer

Generally no — they damage memorability more than they help entropy. A 5-word EFF passphrase already has 65 bits of entropy. Adding one symbol contributes log2(33) ≈ 5 bits — the same as adding ~0.4 words. Just add another word instead. The exception is when a service requires non-letter characters in passwords (annoying but real). For those cases, the 'Numbers' or 'Numbers and Symbols' separator options inject characters between words while preserving the passphrase structure.

Diceware Passphrase Generator

Why Passphrases Win

Frequently Asked Questions