What is an XKCD-style password?
XKCD comic #936, “Password Strength,” contrasts a short password built from predictable substitutions with four independently selected common words. The memorable example from the comic is widely repeated, so never use the published phrase itself as a password. Select Use XKCD-style settings above to generate four lowercase words separated by spaces without a suffix.
How random are four words?
Each word is chosen independently from the 7,776-entry EFF long word list. Four words have 7,776⁴ possible combinations—about 3.66 quadrillion combinations, or 51.7 bits. This is more than the comic's historical estimate because this tool selects from a larger documented word list.
Why add a number and symbol?
A uniformly selected three-digit number contributes about 9.8 bits, and one selection from eight safe symbols contributes 3 more bits. Together with four words, the default reaches about 64.5 bits. The displayed total changes when you switch either option off.
Is a four-word passphrase strong enough?
Four random words can be suitable for many rate-limited online accounts when the service accepts the length. EFF's current dice-generated passphrase guidance recommends six words from its long list for most applications. For a high-value credential or a secret exposed to offline guessing, use the configurable generator with six or more words, or a fully random password stored in a password manager.
Random words are different from a sentence
Lyrics, quotations, common sayings, and personal phrases are easier to predict than independent random selections. Keep all four generated words unchanged, use the result for only one account, and store it securely.
Choose another word format
The three-word generator provides a shorter compatibility option with a larger default suffix. Use the five-word generator for more word-only entropy, the configurable passphrase generator for other word counts, or the Diceware generator when you want to select words with physical dice.