How many bits is your passphrase actually worth?

"Use a passphrase, not a password" is good advice that usually arrives with no numbers attached. The honest version is simple arithmetic: a passphrase's strength in bits is just the number of words times the bits each word carries, plus whatever you tack on the end. Once you can do that sum yourself, you can judge any passphrase scheme — including this tool's — instead of trusting a colour bar.

The method

1. Find the size of the word list the generator draws from. This is the whole basis of the calculation, so a vague "thousands of words" claim is not enough — you need the actual count.
2. Take log2(list size) to get the bits per word. A list has to be a power of two for this to come out exact with no rounding; 2048 words is 2^11, so each word is worth exactly 11 bits, no footnote needed.
3. Multiply bits-per-word by the number of words in the phrase. Each extra word multiplies the attacker's guesswork by the list size, which is the same thing as adding a fixed number of bits — that's why "add one more word" is a bigger jump than it sounds.
4. Add the bits from anything appended, like a trailing number, using the same log2() rule on however many values that piece can take.
5. Compare the total against what you're protecting: an online account that locks out after a few failed tries is a different threat than a stolen password database an attacker can guess against offline, at their own pace, for as long as they like.

A worked example

This site's passphrase generator draws from a 2048-word list and appends a two-digit number from 10–99.

• Per-word bits: log2(2048) = 11 exactly, because 2048 is 2^11.
• Tail bits: the tail has 90 possible values (10 through 99 inclusive), and log2(90) ≈ 6.49.
• Default length is 6 words: 6 × 11 = 66 bits from the words, plus 6.49 from the tail ≈ 72.5 bits total.
• Drop to 4 words: 4 × 11 = 44, plus the same 6.49 tail ≈ 50.5 bits.
• Go up to 8 words: 8 × 11 = 88, plus 6.49 ≈ 94.5 bits.

Each additional word adds a flat 11 bits, every time, because the list size never changes — that's the power of the multiply-through arithmetic, not a diminishing-returns curve the way adding characters to a weak password can feel.

Why list size has to be a power of two

If a word list held, say, 1500 words instead of 2048, log2(1500) ≈ 10.55 bits — a number that needs rounding and a footnote to state honestly. Worse, picking a word with uniform randomness from a list that isn't a power of two using random() % list_size introduces a small statistical bias toward the first few entries, because 2^64 (the usual source of randomness) doesn't divide evenly by 1500. With exactly 2048 words, the division is exact: no bias, and the bit count is the true figure rather than an upper bound.

Where this actually matters

A 50.5-bit, four-word phrase is fine for a login that locks you out after five tries — the attacker never gets anywhere near enough guesses to matter. It is not fine for an encrypted file or a password-manager master password, where someone with a copy of the file can throw a GPU at it offline for weeks without you ever knowing. The fix in that case isn't a stronger-feeling phrase — it's more words, because the arithmetic is exact: one more word is always exactly log2(list size) more bits, no matter how many words you already have. The Passphrase generator prints this exact bit figure, with the word count and list size it was computed from, on every phrase it builds.