PPasswordForge
Get PasswordForge

PasswordForge · password strength

How strong is a 3-word passphrase?

A 3-word passphrase drawn from the 7,776-word Diceware list carries 38.8 bits of entropy. Each additional word adds 12.9 bits — more than two extra random letters, and far easier to remember.

These numbers describe a password generated at random. A password a person invented — a name, a date, a word with letters swapped for digits — is worth a fraction of the same length, because an attacker guesses the pattern, not the alphabet. Entropy measures the dice, not the string.

Entropy and keyspace

AlphabetEntropyPossible passwordsVerdict
Diceware word list (7,776 words)38.8 bits470,184,984,576weak

Time to exhaust half the keyspace

Each column states the guess rate it assumes. A crack time quoted without a rate is meaningless — the same password is minutes or millennia depending on whether the attacker is typing into a login form or running eight GPUs against a stolen hash.

Attack38.8b
Online, rate-limited (10 guesses/sec)745 years
Online, no throttling (1 000/sec)7.4 years
Offline, slow hash — bcrypt cost 12 (20 000/sec)136 days
Offline, fast hash — salted SHA-256 on 8 GPUs (100 billion/sec)2.4 seconds
Offline, well-funded (100 trillion/sec)under a second

Generate one at this strength

The generator runs in your browser using the operating system's cryptographic random source — nothing is sent anywhere. Pick a length or a word count, see the entropy update as you go, and export a batch when you need many at once.

Open PasswordForge

Other strength questions