Generate an XKCD-Style Password — Free "correct horse battery staple" Generator

Ever stared at a login screen, completely blank on what password you used — was it n98idhi3n or something even more forgettable? The XKCD Style Password Generator solves that maddening problem by giving you word combinations that are genuinely hard to guess yet effortless to carry in your head. Instead of wrestling with garbled character strings, you walk away with something like pleased excellence space strain — a phrase your brain can actually hold onto, backed by real cryptographic protection.

How This xkcd Style Password Generator Works — The Science Behind the Comic

Understanding Randomness and the XKCD Comic 936 Concept

The inspiration behind this tool is XKCD comic #936, titled "Password Strength." The strip uses a visual aid — a set of annotated boxes — to compare two passwords side by side. The first is Tr0ub4dor&3: an uncommon base word, a caps substitution, common substitutions (the letter o replaced by zero), a punctuation symbol appended, a numeral appended, and an order unknown twist. The strength breakdown lands around 28 bits of unpredictability — roughly \(2^{28}\), or about 3 days at 1,000 guesses per second for a plausible attack on a weak remote web service. Difficulty to guess: easy. Difficulty to remember: hard.

The second password in that illustration is correct horse battery staple — four common words strung together. Each word contributes approximately 11 bits of combinatorial strength from a word frequency standpoint, summing to roughly 44 bits of unpredictability total, or \(2^{44}\): about 550 years at the same 1,000 guesses per second. Difficulty to guess: hard. Difficulty to remember: you've already memorized it. The strip's caption captures 20 years of effort that trained everyone to use credentials that are hard for humans to remember but easy for computers to guess.

The core principle is rooted in cryptography and linguistics: each additional word you string together makes a brute force hacking attempt exponentially harder. A single dictionary word is easy to guess and can be broken in seconds. Add a second word and the degree of uncertainty grows multiplicatively. Add a third and fourth, and you're looking at combinations that become prohibitively expensive for even GPU-accelerated rigs running 500 billion attempts every second.

"Modern password crackers combine different words from their dictionaries… This is why the oft-cited XKCD scheme for generating passwords — string together individual words like correcthorsebatterystaple — is no longer good advice. The password crackers are on to this trick." — Bruce Schneier

The security researcher raised this objection, but the unpredictability calculation for this scheme already assumes the worst case scenario: that an attacker knows exactly which vocabulary set was used and attempts every possible word combination from the known dictionary. In other words, the scheme accounts for a dictionary attack from the start. If four words feel insufficient for your threat model, simply add a fifth or use a larger vocabulary — the guessability drops with each additional word. As one highly-voted answer on the Information Security Stack Exchange explains, the approach holds up under scrutiny when you understand how credential unpredictability actually works.

The title text of the strip offers a wry aside: "To anyone who understands information theory and safety and is in an infuriating argument with someone who does not (possibly involving mixed case), I sincerely apologize." That nod to letter-case debates captures the frustration of explaining why correcthorsebatterystaple outperforms Tr0ub4d0r in real credential protection, even though the latter looks more intimidating.

Why Word-Based Passwords Beat Character-Scrambled Ones for Memorability

Human memory is associative and narrative — your brain latches onto images, stories, and sequences far more readily than it retains arbitrary character strings. A word-based credential like pleased excellence space strain can be mentally rehearsed as a short scene, making it a truly memorable password. A scrambled string like n98idhi3n offers no such hook and is genuinely hard to remember. From a usability standpoint, credentials you can actually recall reduce the risk of insecure behaviors like writing them on sticky notes or reusing the same phrase across every account. Studies confirm that people revert to weak choices when complexity demands exceed what human memory can sustain.

This is the novel idea the strip recommends, and it's why an inspired tool like this one has found a community of users across cybersecurity, infosec, and developer circles: it genuinely resolves the tension between robustness and memorability.

Generating Secure Word Combinations — Commands, Vocabulary Sets, and Presets

Basic and Extended Password Generation with Unpredictability Control

Once set up, using this password generator tool to create a secure word-string takes a single command. Running xkcdpass with no flags produces four common words drawn from the default vocabulary set:

$ xkcdpass
pleased excellence space strain

That output of four common words — essentially four common words combined as a passphrase — uses the default collection of everyday English terms. With approximately 11 bits of combinatorial strength per word and a sizeable set of around 2048 words (the strip suggests \(2^{11} = 2048\)), a four-word phrase delivers roughly 44 bits of unpredictability. For contexts demanding higher robustness — think email accounts, banking credentials, or anything protecting highly valuable secrets — bump the word count with the -c flag:

$ xkcdpass -c 6
simplified far shade warranty carmen mess

A six-word combination from the same set reaches approximately 65 bits of combinatorial strength (\(6 \times 11 = 66\) bits), which puts it well beyond what GPU rigs running at full throttle can realistically tackle. Even at 500 billion attempts per second, the attack would require far longer than a human lifetime. Adding five or six words is the practical recommendation for account protection under most reasonable threat models.

The unpredictability formula scales cleanly. If your vocabulary set has \(N\) words and you choose \(k\) of them at random:

So with 8192 words (\(\log_2(8192) = 13\) bits per word) and five words, you get 65 bits of combinatorial strength — enough for all reasonable threats including the worst case scenario of a stolen hash subjected to offline hashing attacks with GPU hardware.

Using a Custom Vocabulary Set for Domain-Specific Output

The default vocabulary set is a curated collection of everyday English terms chosen for their word frequency in common text — emphasising the most frequent occurrences in everyday reading. This matters for recall: unusual words like decimalisation contrapuntal are harder to visualise and remember, defeating the whole point of the word-based approach. The built-in set avoids such terms intentionally.

For teams wanting language-specific or domain-specific output, you can supply your own vocabulary file or combine multiple sources:

$ xkcdpass -w wordlist1.txt -w wordlist2.txt
bureau canyon festival mirror rapid autumn

Combining a compact set and an expanded set increases the total vocabulary pool, raising the combinatorial bits per word and making each output stronger. An expanded set of 8192 words versus a compact set of 1949 words delivers meaningfully different unpredictability per pick. Community members have submitted curated sets in multiple languages, and the project page lists forks with specialised vocabularies.

Randomness matters: This generator uses window.crypto.getRandomValues() — the only cryptographically-secure random number generator available in JavaScript environments — rather than Math.random(). The latter is explicitly discouraged for credential creation because it is not a secure source of unpredictability and can produce predictable sequences. True unpredictability is what makes the degree of uncertainty in your output meaningful. Never generate passwords with a tool that relies on Math.random().

Presets, Settings, and Config Management

The web-based xkpasswd interface extends the CLI tool concept with a full settings panel. You can configure word count, separators (dash, dot, space, or custom punctuation), capitalization (mixed case, title case, or all-caps), and numeral insertion positions. Once you've dialled in your personal configuration, the tool generates a config URL you can bookmark — saving your current settings without requiring an account. You can also copy config details to share a preset with a colleague or load config from a shared link, making it easy for teams to standardise their chosen scheme.

Bulk output is another feature: rather than creating one multi-word phrase at a time, you can generate passwords in batches — useful for provisioning multiple accounts or seeding a credential manager like KeePass. Presets include sensible defaults for web logins, Wi-Fi phrases, and high-protection contexts.