Passphrases.
Memorable adjective → noun → verb → adverb passphrases, peppered with digits and symbols.
Generated on demand. TronKits does not store or log generated passphrases.
Tip: use a password manager and avoid reusing passphrases across sites. More utilities →
How these passphrases are built
The generator strings together real words in adjective → noun → verb → adverb order (repeating the pattern for longer phrases), randomly capitalizes some first letters, and puts a random digit or symbol between the words and at the end. It keeps adding words until the phrase is at least your length; Exact length retries until it lands on the length exactly. Every result has at least one capital, one digit and one symbol.
Where it runs. Unlike most tools on this site, the passphrases are made
on the server. The page calls /api/passphrases with only three settings
(length, count and exact-length), a Python script on the server picks the words, and the
list comes back to your browser. The passphrases aren't written to disk or a database.
The server's access log records the request URL, which contains only those three
settings. The API is limited to 30 requests a minute per IP address.
How strong. The word lists hold 941 adjectives, 3,402 nouns, 1,485 verbs and 771 adverbs. Assuming an attacker knows exactly how the phrase was built, a four-word phrase carries about 66 bits of randomness: about 42 from the words, 21 from the four separators (each one of 35 characters) and up to 4 from capitalization. A three-word phrase is about 50 bits. More words is the cheapest way to add strength.
Where the randomness comes from. Every choice (each word, separator and
capital letter) is made with Python's secrets module, which draws from the
operating system's cryptographically secure random number generator, the same source used
for encryption keys. The one thing it can't change is that the phrase is created on a
server you don't control, so for a password-manager master password or a disk-encryption
key you may still prefer your password manager's own generator or dice-based Diceware.
Questions people actually ask
Is the passphrase generator cryptographically secure?
Yes. Words, separators and capitalization are all chosen with Python's secrets module, which uses the operating system's cryptographically secure random number generator rather than the predictable random module.
Are the generated passphrases stored or logged?
No. They are generated on the server, sent back to your browser and not saved. The server's access log records the request URL, which only contains the length, count and exact-length settings, never the passphrases.
How long should a passphrase be?
Aim for 14 characters or more, and longer for important accounts such as email and banking. The generator defaults to 20 characters and won't go below 12.
Is a passphrase stronger than a random password of the same length?
No. A 16-character password drawn at random from all 94 printable ASCII characters has about 105 bits of randomness, far more than a 16-character passphrase. The advantage of a passphrase is that it is easier to read, type and remember, so you can afford to make it longer.
What does the Exact length option do?
Without it, the generator adds words until the phrase reaches at least your length, so results often run a few characters over. With it, the generator retries (sometimes using two-character separators) until the phrase is exactly the requested length.
Can I generate several passphrases at once?
Yes. Set the count anywhere from 1 to 50, then copy a single passphrase or copy them all at once.
Should I use the same passphrase on more than one site?
No. Use a different one for every site, because one breached site would otherwise unlock the others. A password manager makes that practical, and turning on multi-factor authentication adds another layer.