How strong is a six-word random passphrase?
Six words picked at random from the EFF long list create 221,073,919,720,733,357,899,776 possible passphrases, equal to an estimated 77.55 bits.
Random selection matters: a passphrase can be much easier to guess when someone chooses the words. A separator or capitalization pattern only adds randomness if that choice also changes at random.
How many combinations does a random passphrase have?
Four random EFF words create 3,656,158,440,062,976 combinations. Six words create 221,073,919,720,733,357,899,776, while eight words create 13,367,494,538,843,734,067,838,845,976,576.
| Words | Exact combinations | Estimated bits |
|---|---|---|
| 4 | 3,656,158,440,062,976 | 51.70 |
| 5 | 28,430,288,029,929,701,376 | 64.62 |
| 6 | 221,073,919,720,733,357,899,776 | 77.55 |
| 8 | 13,367,494,538,843,734,067,838,845,976,576 | 103.40 |
How long are the words in the EFF list?
The average word is 6.99 characters long, the median is 7.0, and every word falls between 3 and 9 characters. We checked every word in the list, not a sample.
- Total
- 7,776 words
- Average
- 6.99 characters
- Median
- 7.0 characters
- Range
- 3–9 characters
How did we calculate these figures?
We keep combination totals as exact whole numbers. When a report includes time estimates, we keep them as exact fractions of a second and use 31,557,600 seconds per year for the readable versions. Entropy estimates use length × log2(alphabet size) and assume every choice is random and equally likely. The source file contains 7,776 unique entries with SHA-256 addd35536511597a02fa0a9ff1e5284677b8883b83e986e43f15a3db996b903e. Possible combinations are 7776^W.
These are calculated examples, not tests of real attacks or specific hardware. The EFF word-length figures are different: they count every word in the published list.
Where do the word list and figures come from?
- Electronic Frontier Foundation, Dice-Generated Passphrases — EFF's guide to making passphrases with dice.
- EFF Long Wordlist for Passphrases — the full 7,776-word list used for this report.
- NIST SP 800-63B-4, Appendix A: Strength of Passwords — explains why random selection is different from choosing words yourself.
- Release 1 data and calculation details — the word counts, formulas, checksums, and full set of results.
EFF provides the word list and dice codes. We used that list to calculate the totals, entropy estimates, and word-length figures shown here.
These estimates assume each word is picked at random from the full list, with every word equally likely. A passphrase someone invents will not follow the same math. We also do not count a fixed separator or capitalization pattern as extra randomness.
EFF list retrieved 2026-09-23 and verified against SHA-256 addd35536511597a02fa0a9ff1e5284677b8883b83e986e43f15a3db996b903e. NIST source reviewed 2026-10-21.
Can you download or cite this data?
Yes. Download the complete release, the passphrase combinations, or the word-length counts.
Suggested citation: “Generate My Password, Passphrase Security Statistics, release password-statistics-release-1-v1 (2026-10-21).”
Related research
Compare uniform character models, inspect search-time assumptions, browse the EFF word list, or generate a Diceware passphrase.