Passphrase generator

How it works

Each word is picked by drawing one random byte from crypto.getRandomValues() and indexing into a fixed 256-word list, so every word carries exactly 8 bits of entropy (log2(256) = 8) with no bias toward any word - unlike Math.random(), which isn't guaranteed to be cryptographically secure. Total entropy is just 8 bits times the word count, plus roughly 3.3 bits if you add the optional trailing digit.

FAQ

Why 256 words specifically?

256 is a power of two, so a single random byte (0-255) maps onto the word list with zero bias - no word is ever slightly more likely than another, which wouldn't be true with an oddly-sized list and a modulo operation.

Is a 5-word passphrase actually secure?

At 8 bits per word, 5 words gives 40 bits of entropy - reasonable for many accounts, but for anything high-value, 6 or more words is safer since each extra word multiplies the guessing space by 256.