Diceware Passwords

Diceware passwords are the only passwords that are both easy to use and strong enough to be useful.

This page will create some for you, and teach you how to do it yourself.

Diceware Password Generator

Why is this secure?

Strong passwords can be stolen just as easily as weak passwords. What makes one password stronger than another is how difficult it is to guess.

The more random a password, the harder it is to guess.

Humans are really bad at random. Even when we try to come up with something random, it turns out to be not as random as we thought. And random is hard to remember, so we usually don't even try.

Hence, we use weak passwords.

But "diceware passwords" help solve this problem, by giving us something we can memorize—six random words—that is still random enough to be secure.

But don't English words make weak passwords?

Generally, yes. Dictionary words in any language are terrible passwords, for several reasons. So are known phrases, even obscure lines from Shakespeare.

The strength of a diceware password comes from the fact that enough words (six or more) are drawn at random from a large list of words. If the source word list is large enough, and the words are chosen randomly, then there is enough "entropy" (randomness) in the password to make the odds of guessing it vanishingly small.

For example, the odds of guessing a six-word passphrase generated from this page (or with real dice, even better—keep reading) is less than 1 in 200 sextillion.

Using real dice

Real dice from your game closet are harder to hack than the random number generator on your computer (which is what the code on this page is using). So for extra security, you can generate these passwords yourself, with pencil and paper and dice.

It's this easy:

1. Download the word list
2. Roll 5 six-sided dice. Or, equivalently, roll one die five times.
3. Combine the results of the dice rolls into a 5-digit index. For example, dice rolls of 4, 1, 3, 6, and 5 (in that order) would combine to make the index 41365.
4. Look up the index in the word list. The corresponding word is the first word of your passphrase.
5. Repeat until you have a passphrase of six words or longer.

Warning

Resist the temptation to selectively re-roll the dice anytime it gives you a word you don't want to use. That would defeat the purpose of rolling dice. (Humans are bad at random.)

Instead, if you don't like the resulting password for some reason, you may repeat the entire process until you get a randomly-generated passphrase you can live with. (Annoying, perhaps, with real dice, but just another click if you're using the tool here.)