Memorable Password Generator

How the Memorable Password Generator works

Memorable password generator: meeting the rules without the gibberish

Most sites still enforce composition rules: at least one capital, one lowercase letter, one digit and one symbol, often within a length limit that rules out a long passphrase. The traditional answer is a random string like k7#Qp2!vLm9x, which is strong and which nobody remembers, so it gets reused or written on a sticky note. This generator produces something like CactusVelvetOrbit?417 instead: three random words you can picture, a symbol, three digits. It passes the rules, fits in a 20-character limit, and after typing it a handful of times it sticks.

Where the strength comes from

Each word is drawn from 7,776 possibilities, contributing 12.9 bits; the symbol from 14 adds 3.8 bits and the three digits add 10 bits. Three words is 52.5 bits in total, four is 65.4. The capitals add nothing, because the pattern is known — and it is worth being honest that the attacker is assumed to know the pattern. Strength in a password comes from the number of equally likely possibilities, never from the attacker not knowing how it was built.

Two words is only enough for throwaway accounts. Three is the sensible default for ordinary accounts that sit behind a login rate limit, where an online attacker gets a few hundred guesses before being locked out. Four or more is for anything that could be cracked offline.

Why the words are random and not yours

The temptation is to pick your own words, and the result is always weaker than it looks. People choose nouns they like, in a natural order, from a vocabulary of a few thousand common words, and cracking tools have dictionaries of exactly those. Three random words from a fixed list have a known, calculable strength; three words you chose do not, and the honest estimate is much lower. Regenerate until a password appeals to you — rejecting candidates costs nothing — but do not edit the words.

Memorable versus passphrase

The passphrase generator on this site produces lowercase words with a separator, which is stronger per character and easier to type, and is the better choice wherever the site accepts it. This page exists for the sites that do not: the ones with a 16 or 20 character cap, or a rule that rejects spaces and hyphens, or an insistence on mixed case and a symbol. Same wordlist, same random source, packaged to pass a stricter form.

Generated locally, never sent

The wordlist is embedded in the page and the words are chosen by your browser's cryptographic random generator. No request is made when you generate, nothing is logged, and the passwords exist only in the box until you copy them. Use one per account, and keep them in a password manager so that memorability is a convenience rather than the only copy.

Related tools