Skip to main content
Back to Numbers generators

Numbers

XKCD-Style Password Generator

Used by developers, writers, and creators worldwide.

The XKCD-style password generator creates strong, memorable passwords by chaining random common words — the method made famous by XKCD comic strip 936's "correct horse battery staple" example. Four random words from a 2,000-word list produces over 160 billion combinations, making brute-force attacks impractical without the visual noise of "Tr0ub4dor&3". You control the variables that actually matter. Set the word count (four words for everyday accounts, five or six for master passwords and encryption keys), pick a separator that fits the target system — hyphen, dot, underscore, space, or none — and optionally append a random number to satisfy the digit requirements most sites enforce. Generate up to several at once and keep whichever phrase sticks.

Loading usage…

Free forever — no account required

How to use

  1. Choose your options above
  2. Click Generate
  3. Copy your result

Detailed instructions

  1. Set the word count slider to 4 for standard security or 5-6 for high-value accounts like master passwords.
  2. Choose a separator that matches where you'll use the password — hyphens for most accounts, no separator for length-limited sites.
  3. Toggle 'Add random number' to Yes if the target site requires a digit in the password.
  4. Set the count to 5 or more so you have several options and can pick the phrase that sticks naturally in memory.
  5. Click Generate, read through the results aloud, and copy the one that feels most memorable to you.

Use Cases

  • •Creating a master password for a Bitwarden or 1Password vault you must memorize
  • •Setting a shared Wi-Fi password guests can type correctly on the first attempt
  • •Generating a LUKS or VeraCrypt disk-encryption passphrase you need at every boot
  • •Seeding a staging environment with realistic credential fixtures for Cypress login tests
  • •Teaching a security workshop why passphrase length beats symbol-substitution complexity

Tips

  • →Read generated phrases out loud — if you can say it as a quick sentence or mental image, you'll remember it far longer.
  • →For disk or vault encryption, generate 10+ passwords and sleep on it; the one you still recall the next morning is the one to use.
  • →Avoid setting word count below 4 — three words may fall short of entropy requirements on security-audited systems.
  • →If a site rejects hyphens, switch the separator to underscore or none rather than shortening the word count to compensate.
  • →When sharing a Wi-Fi password verbally, the hyphen separator makes it easy to spell out word-by-word without confusion.
  • →Combine a 5-word passphrase with a hardware security key on your most critical accounts — the passphrase protects the key, not the account alone.

FAQ

are random word passwords actually as secure as random character passwords

Yes, with enough words. Four words from a 2,000-word list gives roughly 44 bits of entropy — comparable to a strong 8-character random password, but far less likely to be reused or written on a sticky note. Add a fifth word and you comfortably exceed most random-character alternatives.

does this generator send my passwords to a server

No. Everything runs in your browser — no inputs, no generated words, and no results leave your device. You can go offline and it still works. That said, avoid generating passwords on shared or public computers where screen-capture tools might be running.

which separator should I pick for xkcd passwords

Hyphens are the safest default: readable and accepted by almost every site and system. Use underscores when a system rejects hyphens as special characters. Skip the separator entirely only when a site enforces a strict character limit, since it saves characters at the cost of readability.