PPasswordForge
Get PasswordForge

PasswordForge · password strength

How strong is an 8-word passphrase?

A 8-word passphrase drawn from the 7,776-word Diceware list carries 103.4 bits of entropy. Each additional word adds 12.9 bits — more than two extra random letters, and far easier to remember.

These numbers describe a password generated at random. A password a person invented — a name, a date, a word with letters swapped for digits — is worth a fraction of the same length, because an attacker guesses the pattern, not the alphabet. Entropy measures the dice, not the string.

Entropy and keyspace

AlphabetEntropyPossible passwordsVerdict
Diceware word list (7,776 words)103.4 bits1.34×10^31great

Time to exhaust half the keyspace

Each column states the guess rate it assumes. A crack time quoted without a rate is meaningless — the same password is minutes or millennia depending on whether the attacker is typing into a login form or running eight GPUs against a stolen hash.

Attack103.4b
Online, rate-limited (10 guesses/sec)2.1×10^22 years
Online, no throttling (1 000/sec)2.1×10^20 years
Offline, slow hash — bcrypt cost 12 (20 000/sec)1.1×10^19 years
Offline, fast hash — salted SHA-256 on 8 GPUs (100 billion/sec)2.1×10^12 years
Offline, well-funded (100 trillion/sec)2.1×10^9 years

Generate one at this strength

The generator runs in your browser using the operating system's cryptographic random source — nothing is sent anywhere. Pick a length or a word count, see the entropy update as you go, and export a batch when you need many at once.

Open PasswordForge

Other strength questions