Passphrase generator

Memorable passwords made of random words. Easy to remember and type, very hard to guess.

Calculating…

Generated in your browser. Your password is never sent to us.

What next?

Send it securely

Get a link to send to a friend, and we can email it to them for you. When they open it, they see your password. Then the link stops working, so nobody else can ever see it.

For the geeks: how secure is it?

Your password is locked with AES-256-GCM encryption on your device before anything is sent. The key that unlocks it is the part of the link after the #. Browsers never send that part to a website, so our server only ever holds scrambled data it can't read.

When the link has been opened the number of times you chose, or when it runs out of time, the scrambled data is deleted for good. Nobody opens it before your friend does, because they have to tap “Reveal” first; link previews in chat apps can't use it up.

This tool has its own page to share: pass.new/send

Split a password into blocks

Split a password, Bitcoin key or seed phrase into 5 printable blocks for people you trust. Any 3 bring it back. 1 or 2 reveal nothing.

Next, you can print the blocks or save them as a PDF.

This tool has its own page to share: pass.new/split

Check a password

Find out if a password is strong, and whether it has been leaked by a hacked website. Your password never leaves your device.

For the geeks: how secure is it?

Strength is measured on your device with zxcvbn, which spots common words, patterns and substitutions.

For the leak check, your device turns the password into a SHA-1 fingerprint and sends only its first 5 of 40 characters to Have I Been Pwned. It replies with every leaked fingerprint starting that way (hundreds of them), and your device looks for a match. This is called k-anonymity: neither they nor we can learn your password.

This tool has its own page to share: pass.new/check

Time-lock

A secret link that can't be opened until the date you choose. Good for surprises, wills and future reminders.

This tool has its own page to share: pass.new/timelock

Dead man's switch

Leave a message for loved ones, released only if you stop checking in. We can never read it.

  1. Write your message. It's locked on your device.
  2. Choose who gets it, and how often you'll check in.
  3. Miss a check-in and we remind you. If you still don't respond, it's sent.
Set up a switch

Canary token

A decoy login that emails you the moment anyone snoops.

  1. We make a fake password and a trap link.
  2. Hide them where an intruder would look, like a notes app or a shared drive.
  3. If anyone opens the link, you get an email straight away.
Set a canary
Building something? Generate passwords and send secure links from your own app with our free API. View the API

Questions

What is a passphrase?

A password made of random words joined together, like curl-owl-hut-chief-77. It's easier to remember and type than random characters, and still very hard to guess.

How many words should my passphrase have?

5 or 6 random words for important accounts such as email, banking and your password manager. 4 words is fine for less important ones.

Is a passphrase as strong as a random password?

It can be. Strength comes from randomness: 6 random words from our list (plus the number) is about as strong as a random 10 or 11-character password, but far easier to remember.

Where do the words come from?

The EFF short wordlist: 1,296 common, easy-to-spell words chosen for passphrases. Each word is picked at random in your browser.

Why is there a number at the end?

Many websites insist on a number. Adding a random two-digit number means your passphrase is accepted almost everywhere, and makes it a little stronger.

Is it safe to make my passphrase here?

Yes. It's made in your own browser and never sent to pass.new or anyone else. Prefer random characters? Use the password generator.