Password Generator

Village carries umbrella Very Strong · 125.4 bits 17.5 bits (word-pool)

Lonely castle reaches curtain Very Strong · 148.2 bits 23.3 bits (word-pool)

Cheerful shadow gathers crown Very Strong · 148.2 bits 23.3 bits (word-pool)

Statue invites giant paper Very Strong · 131.1 bits 23.3 bits (word-pool)

River collects bottle Very Strong · 108.3 bits 17.5 bits (word-pool)

Museum helps button Very Strong · 96.9 bits 17.5 bits (word-pool)

Puzzle dreams loyal button Very Strong · 131.1 bits 23.3 bits (word-pool)

Beacon collects lamp Very Strong · 102.6 bits 17.5 bits (word-pool)

Jacket greets cabin Very Strong · 96.9 bits 17.5 bits (word-pool)

Ancient compass greets compass Very Strong · 153.9 bits 23.3 bits (word-pool)

This is a quick way to generate longer passwords — passphrases — that are far easier to remember than a string of random characters, but not so predictable that they are an easy target. Rather than pulling from common sayings or phrases (the kind that show up in "known phrase" attack lists), this tool builds each passphrase from random combinations of everyday nouns, verbs, and adjectives, so the result reads like a sentence but is not one anyone has used before. Add a few digits or symbols to the end, and you get something that is both memorable and genuinely hard to guess.

A "standard" 8-character password — the kind most sites require, with a mix of case, digits, and a symbol — lands around ~52 bits. That is the theoretical ceiling too; in practice it's often lower, since people don't pick characters uniformly at random (common substitutions like "@" for "a" or capitalizing only the first letter cut the real entropy well below 52 bits).

For comparison, these passwords — even a plain three-word phrase with no digits or symbols — land well above that (character-space entropy alone tends to run 40s-to-60s bits, and the true word-pool entropy is often 90+ bits). They are both longer and more memorable, but harder to brute-force than the "8 characters with a symbol" convention most people default to.

A few notes on this implementation:

Looks at each generated phrase and determines R (the alphabet size) by checking which character classes actually appear — lowercase, uppercase (just the leading capital from ucfirst), digits, and a specials pool. So R grows only when those digit/special options are actually used.
E = L × log2(R), with L counted excluding spaces (since word boundaries are fixed by the template and do not add real guessing entropy).
A small entropy_rating() helper that buckets the bit count into Weak/Fair/Strong/Very Strong with matching W3.CSS tag colors, displayed next to each passphrase.

L·log2(R) "charset search space" formula is the conventional way sites report entropy, but this actually understates how strong this generator really is — the true entropy comes from the word-pool and template combinatorics (noun pool × noun pool × verb pool × adjective pool × 3 templates × digit/special combinations), which is a much bigger number since an attacker guessing against this scheme would need to know the word lists, not just brute-force characters.

The combinatoric figure is computed exactly per phrase, not just estimated:

2 × log2(64 nouns) for the two noun slots, + log2(45 verbs)
log2(56 adjectives), but only when the chosen template actually places the adjective in the visible output (template 0 draws an adjective it never uses, so that draw carries zero real entropy
digit_count × log2(10) and special_count × log2(14) for the appended suffix

Everything is summed as logs rather than multiplied out, so there is no integer overflow risk even if the word pool is expanded later. The word-pool number is meaningfully higher than the char-space number — that is expected, since the char-space formula treats the phrase as a flat string of arbitrary characters, while the word-pool number reflects that an attacker actually has to search sentence-structures, not just character strings.