// local browser tool
Passphrase Generator controls
Runs in this tab. Nothing you type is uploaded.Passphrase Generator creates browser-local passphrases for people who need something usable, not just random-looking. The verification card gives a safer readback pattern: word count, initials, separator, length, and a short check value so a person or admin can confirm the phrase without saying the whole secret out loud.
What it does
- Generates passphrases from local browser controls.
- Supports word count, separator, source, tone filter, extras, and casing options.
- Creates a verification card for partial readback.
- Keeps the generated phrase on the page until the user copies or replaces it.
The EFF long list and the default calm-neutral filter serve one practical goal: the final pool should contain words end users will actually use without surfacing offensive or needlessly awkward language. The tone filter matters because a uniform draw from a general wordlist will eventually produce a credential made of medical, violent, or distressing words, and this tool exists for phrases a person has to say out loud to a colleague during a handoff. Filtering costs real entropy — a smaller pool means fewer bits per word — so the strength readout is computed from the filtered pool that was actually drawn from, not from the nominal size of the source list.
Use cases
- Create a memorable phrase for a human-managed login.
- Draft a stronger recovery phrase for an admin handoff.
- Generate a bootstrap secret before storing it in the right vault.
- Keep policy notes beside the generated phrase before it leaves the browser.
Local privacy boundary
Generation happens in the browser. The phrase, selected options, and verification card are not sent to graysond.xyz, analytics, AI providers, or third-party services.
The words are drawn with crypto.getRandomValues rather than Math.random, and each draw discards any value landing in the final partial block of the 32-bit range before taking a remainder. Skipping that step would leave a modulo bias: a couple of thousand words in the pool would each be very slightly more likely than the rest. It is far too small to ever notice in a generated phrase, and it costs nothing to remove, so it is removed.
Verification card
The card gives a partial readback pattern instead of repeating the whole secret: word count, initials, separator, total length, and a short check value.
Limits
A generated passphrase still needs responsible storage, rotation, and access control. This tool does not check whether a phrase has been reused or exposed elsewhere.
Related
Use Passphrase Review to inspect an existing phrase, or read Security for the local-tool boundary.