Should I add my name or a memorable date?

A name or date follows a predictable pattern. Generate independent random characters or words instead. You can invent a story to remember random words after generating them. Do not replace them with words from the story.

Does capitalising every word make a passphrase stronger?

Fixed capitalisation adds no random choice. The same applies to a fixed separator or a digit you always append. A randomly selected two-digit number has 100 possibilities and adds about 6.64 bits. Adding another random word from floi’s 7,775-entry list adds about 12.92 bits.

Should I change passwords every month?

NIST’s current guidance tells service providers not to require periodic changes without evidence of compromise. Change a secret when it has been exposed, reused on a breached service, or otherwise compromised. Keep it unique and follow your organisation’s applicable requirements.

Can I use a generated passphrase as a wallet recovery phrase?

No. Wallet recovery phrases follow a specific scheme, word list and checksum. Generate them only through your wallet’s trusted setup process. A login passphrase is a different kind of secret.

Passwords vs passphrases: what to generate

Choose for the way you sign in. Length matters, but so does how the secret was chosen.

Free toolPassword GeneratorMake random passwords, EFF word passphrases or PINs. Fit your site’s rules, read characters clearly and copy a batch.Generate a password

Use random characters for pasting, random words for typing

Use a long random password when your password manager can save and fill it. Choose a random-word passphrase when you need to remember or type it. Keep a short PIN for systems designed to limit guesses.

Situation	A useful starting point	Check first
An ordinary website account	A unique 20-character random password, saved in your manager.	The site’s maximum length and accepted symbols.
A password-manager unlock secret	A long passphrase of independently selected words. EFF recommends at least six with its large list.	Your manager’s guidance, recovery method and authentication options.
Typing a Wi-Fi password on a TV	A random-word passphrase, if the device accepts its length.	Spaces, separator characters and the supported Wi-Fi security mode.
A digits-only device unlock	A random PIN with as many digits as the system permits.	The system’s limit on wrong attempts and recovery process.

These are starting points, not guarantees for every threat. Passwords cannot stop phishing, malware or a compromised device. Use a passkey or multi-factor authentication where the service supports it.

How long should a password be?

Use the longest practical random password your destination accepts. The generator starts at 20 characters, while the exact length can fit a stricter site.

NIST SP 800-63B-4 requires service providers to use a 15-character minimum for passwords used as a single factor. Its minimum is eight when a password is only part of multi-factor authentication. The same guidance rejects mandatory mixtures of character types. Those are requirements for verifiers, not a claim that every 15-character string is equally strong.

Use a unique generated secret for each account. Reuse lets a breach affect other services.
Meet a site’s rules, then spend extra length on randomness. Replacing letters in a familiar word follows a pattern.
Keep the whole result. Truncating a passphrase or choosing only your favourite words changes its generation process.

Worked examples: what the bits actually measure

The table counts possible outputs from floi’s generator, checked on 28 October 2026. Bits are the base-two logarithm of that count.

Generation rules	Randomness	What is counted
16 characters, all four types required	104.59 bits	Strings over 94 printable non-space characters, containing uppercase, lowercase, digits and symbols.
20 characters, the same rules	130.93 bits	The same valid-string count at 20 positions.
Six random words	77.55 bits	7,775⁶ ordered word selections. Repeated words remain possible.
Six words and a random two-digit number	84.19 bits	7,775⁶ × 100. The number can be 00 through 99.
A six-digit PIN	19.93 bits	1,000,000 strings, including leading zeros and repeated digits.

Method: the character rows use inclusion-exclusion to count only strings meeting all four group requirements. Word and PIN rows use direct multiplication. The independent checks in scripts/check-password-core.mjs include complete enumeration of a small character space. These are calculations of the generation process, not attack timings or measured protection against a breach.

Why “one of each type” changes the calculation

A requirement removes some strings from the allowed set. It does not create extra random choices.

Consider four positions using only A and a. There are 16 possible strings. Requiring both cases removes AAAA and aaaa, leaving 14. Counting 16 would overstate the randomness.

The generator chooses an unbiased random index into the valid strings. Counting valid continuations lets it build that string without retries for missing types. A real site may need those types even though the rule reduces the available set.

Generate a passphrase with physical dice

You can generate words without an online tool. Use physical dice and the EFF’s published method and large word list.

Roll five six-sided dice. Record the results in a fixed order.
Look up that five-digit code in the EFF list. Keep the corresponding word.
Repeat until you have at least six words. Keep the words in their generated order.
Use a fixed separator your destination accepts. Make a memory aid after generating the words.

The published list contains 7,776 entries. Floi removes four internal hyphens and merges the resulting duplicate yoyo. Its 7,775 unique entries make each supported separator unambiguous. This small adaptation is included in the calculations above.

The word list is by the Electronic Frontier Foundation, adapted under CC BY 4.0. The browser version uses Web Crypto rather than dice. Its list loads from floi when you first choose Passphrase.

Generate inside your password manager when you can

Your manager can generate a password directly where it will be stored. That avoids a separate copy-and-save step.

Use an existing vault

Bitwarden and 1Password offer generation inside their apps. Your browser may offer password generation and storage too. Use the workflow you can reliably keep and recover.

Use a standalone generator

Useful for a device setup, an archive or a site with awkward rules. Floi makes the secret, but you must put it somewhere safe yourself.

A browser generator still relies on the page code and your device. Floi’s generated secrets never enter account drafts or analytics events. Normal page analytics can still load, as described in the privacy page.

Before you leave the generator

Save the secret in a trusted password manager and confirm the destination accepts it. The generator cannot recover it later.

Avoid screenshots, email drafts and chat messages as password storage.
Remember that copying puts the secret on your clipboard. Clipboard history and synchronisation may retain it.
Check your recovery options and enable a second authentication factor where available.

Sources and scope

This guide uses NIST SP 800-63B-4 for verifier requirements, EFF’s dice method for random-word advice, and Web Crypto for browser randomness. Reviewed on 28 October 2026. The numerical examples describe this implementation only.