{{ summaryTitle }}
{{ summaryValue }}

{{ summaryLine }}

Words {{ resultsReady ? computation.normalizedInputs.word_count : params.word_count }} Entropy {{ resultsReady ? formatBits(computation.values.total_entropy_bits) : '—' }} Policy {{ resultsReady ? artifact.policyBadge : 'Not checked' }}
Choose 4–12 words; six is the common EFF long-list starting point.
words
Keep word boundaries visible unless a target field requires another shape.
Use capitalization only for readability or a destination policy.
Browser rolls require Web Crypto; manual mode accepts one physical five-dice key per word.
Separate keys with spaces, commas, or new lines. Manual keys are not written to the URL.
The neutral default is none; digits are random and intended only for destination compatibility.
Use 0 for no minimum or mirror a destination requirement up to 128 characters.
chars
Use 0 for no cap or mirror a destination field limit up to 128 characters.
chars
{{ rule.help }}
{{ params[rule.key] ? 'On' : 'Off' }}
{{ row.label }}{{ row.value }}
{{ artifact.guidanceLabel }}. {{ artifact.guidanceDetail }}
PositionDice keyRendered wordEFF wordCopy
{{ row.position }}{{ row.code }}{{ row.renderedWord }}{{ row.word }}
CheckStatusEvidenceNext moveCopy
{{ row.label }}{{ row.status }}{{ row.detail }}{{ row.action }}
Hash Type Identifier Identify likely hash formats from pasted values or local text files with confidence labels, cleanup clues and browser-local analysis.
Secure Password Generator Generate a unique password in your browser with adjustable character rules, unbiased random selection, and clear strength estimates.
API Key Generator Generate cryptographically random API keys in your browser with public lookup IDs, SHA-256 verifier hashes, and issuance warnings.
Secret Pattern Sample Checker Scan config, log and ticket samples for secret-like values with masked findings plus provider signatures, entropy scoring and rotation guidance.

A memorable secret becomes difficult to guess when its words are selected by chance rather than by taste. Diceware turns random dice outcomes into word-list positions. The resulting words may look ordinary, but the selection process creates a large set of possible phrases that an attacker would have to search.

The EFF long list contains 7,776 words, exactly the number of ordered results from five six-sided dice. One five-roll key identifies one word. Repeating the process independently for every position multiplies the search space, so adding a randomly selected word contributes far more than changing predictable capitalization or punctuation.

Choice Changes guessing resistance? Main purpose
Another random word Yes, by another choice among 7,776 words Increase the random search space
Random decimal suffix Yes, by ten choices per digit Satisfy a destination rule with a small entropy increase
Chosen case or separator No Improve readability or pass a format check
Minimum or maximum length Can narrow the accepted set Fit the destination field

Six EFF long-list words are a common starting point and represent about 77.5 bits before any random suffix. The appropriate length still depends on the secret's value, how it will be stored, and the destination's limits. Disk encryption and a password-manager master secret deserve particular care because they can protect many other assets and may face offline guessing.

Randomness does not solve every credential problem. A strong passphrase can still be phished, intercepted by malware, exposed through a clipboard, or compromised when reused. Each account should receive a different secret, and multi-factor authentication should be enabled when available.

Diceware is meant for secrets a person may need to type or remember. Machine credentials such as API keys and cryptographic keys usually belong in a password manager or secret-management system that can create and store opaque random values without a memorability constraint.

How to Use This Tool:

Choose strength first, then adjust the visible format only as much as the destination requires.

  1. Select a Word count from 4 through 12. Six is the built-in EFF starting point; use more words when the protected secret warrants more guessing resistance.
  2. Choose a Separator and Case style. Keep word boundaries visible unless the destination rejects spaces or punctuation.
  3. Choose Browser secure rolls or Manual five-dice keys. Manual mode requires exactly one five-digit key per word, using only digits 1 through 6.
  4. Open the policy controls only when you have a real length cap or character rule to match. Add random suffix digits for compatibility, not as a substitute for a missing random word.
  5. Generate the phrase, check Entropy composition and Policy review, then save the exact result securely. Regenerate rather than editing a word by hand.

Interpreting Results:

Total entropy estimates the random search space represented by the selected words and independently generated suffix digits. It assumes every word choice is uniform and independent. Capitalization and separators are excluded because they are settings an attacker could know.

The Policy review checks length, uppercase, digit, symbol, and whitespace requirements. Passing those checks proves only that the rendered phrase fits the declared rules. It does not prove that the destination accepts the phrase, rate-limits guesses, stores passwords safely, or protects against phishing.

When browser generation retries to meet a length range, inspect Generation attempts and the final policy rows. A result can still miss the requested length after the 64-attempt limit, and conditioning selection on phrase length narrows the set compared with the unconditioned entropy figure.

Technical Details:

Diceware entropy comes from counting equally likely selections. With 7,776 possible words, one independent word contributes approximately 12.9248 bits. A random decimal digit contributes approximately 3.3219 bits.

Formula Core:

The displayed estimate adds the word choices and random suffix choices:

H = n log2 (7776) + d log2 (10)
Symbol Meaning Allowed value
H Estimated total entropy Displayed to one decimal place in bits
n Independently selected EFF long-list words 4 to 12
d Independently generated decimal suffix digits 0 to 4

For six words with no suffix, the substitution is:

H=6× log2 (7776) ≈77.5 bits

Selection Mechanism:

Each five-dice key is interpreted as a base-six position whose digits run from 1 through 6. The key 11111 maps to the first list entry and 66666 maps to the 7,776th. Manual mode uses the supplied keys directly, so its strength depends on honest independent physical rolls.

Browser mode obtains random bytes from the Web Cryptography API. Values outside the largest evenly divisible range are discarded before reduction to six die faces or ten digits. This rejection step prevents modulo bias. Five accepted die faces form each word key, and suffix digits are drawn separately.

Browser mode may generate as many as 64 candidates while trying to satisfy active minimum and maximum lengths. Manual mode does not reroll supplied keys. Case conversion and joining happen after word selection, so changing those settings leaves the word-entropy term unchanged.

The keyspace display uses base-10 scale, while entropy uses base-2 bits. Both describe the same modeled search space. Neither predicts a specific cracking time because attack speed depends on the destination's password hashing, rate limits, breach conditions, and attacker resources.

Responsible Use Notes:

  • Generated words and roll evidence remain in the current browser session, and manual dice keys are not written to the URL. Clipboard copies and downloaded artifacts still need to be treated as secrets.
  • Do not reuse a passphrase or replace random words with personally meaningful choices.
  • Store the result in a password manager before leaving the page, then clear any temporary notes or exports.
  • Use a Web Crypto-capable browser or physical dice. If secure browser randomness is unavailable, generation stops instead of falling back to ordinary pseudo-random selection.

References: