Passkal

XKCD Password Generator

Make a password out of a few short everyday words, in the style xkcd made famous. The words are drawn on your device and never leave your browser.

The xkcd comic made the point that a few ordinary words are easier to remember, and harder to guess, than a short jumble of symbols. This draws those words for you — choose how many you want and how they are joined, and a new one appears every time you change something.

Your password

Strength0 bitsWeak

Strength: Weak, 0 bits

Customize

7
4 words12 words

Every word you add is worth another 11 bits. Seven is a sensible place to start; the comic used four, and the meter above will show you what that costs today.

Separator

Running the words together is the look the comic is known for. It does not change how hard the password is to guess, so pick whichever is easiest to type where you need it.

Extras

Capitalizing helps some forms accept the password, and makes the words easier to pick apart when they run together — but it does not make it harder to guess.

Word source

Common Words2,048 words · 11 bits each

Short everyday words of four to six letters, picked so they stay easy to say and to type even when they run together. Built by Passkal, from the EFF Long Wordlist.

Recent passwords

Nothing here yet. Passwords you generate are kept on this device only, so you can pick one up again later.

Why a few words beat a jumble

Each word here is drawn at random from 2,048 short everyday words, so every word you add multiplies the number of possibilities by 2,048. Nothing about the words themselves is clever. All of the strength comes from how many were drawn and from the fact that nothing but chance chose them.

The comic drew four words, which works out at about 44 bits. That was a fair bar in 2011, but guessing hardware has moved a long way since — measured against someone who has stolen a password database and can try billions of guesses a second on their own machine, four words now reads as weak, and the meter above says so. Seven words is where this tool starts, and where the same style gets comfortably out of reach.

A password like this is worth reaching for when you have to type it yourself or read it out loud — the one on your password manager, your laptop, your phone. For the hundreds of accounts you never type by hand, let a password manager keep a random jumble instead.

Everything happens on your device. Your passwords never leave this browser.