User Tools

Site Tools


diceware

Making a good passphrase: the diceware method

A good passphrase is a passphrase that:

  1. is long enough that you cannot guess it easily with random trials (also called brute force attacks)
  2. if made from elements, is random enough that you cannot guess it from random trials of elements combinations (also called dictionary attacks)
  3. you can remember easily

There is a method that will help you make a strong passphrase with all those characteristics: the diceware method. Here is the website with an explanation, however do not roll dices online, this is not a good practice.

The method is the following:

  1. pick up a long list of words, all indexed by a list of values. I personally use this one, made from texts from the Star Wars universe. I recommand to print it and do it offline
  2. pick a couple of dices, in my case a D20
  3. roll the dice 3 times in my case, this will give you one word
  4. repeat the operation to have enough words. It is considered safe to have at least 6 words

If you do not have a D20

If you do not have a D20 or printed the whole list, you can opt for tools that auto generate the password. However, as said before, you should prefer to do it locally. This piece of code can do it for you, and it seems to be safe: clone the repository (if you know how to do it) or just download the code as a zip folder by clicking on “Code”/“Download Zip”. Then extract the folder, and open the file “dicewareGenerator.html”. This will normally open your favourite browser, but with a local file: this way, you are not connected to the internet. Then click on browse, and select the eff long wordlist in the extracted repository. You can then generate a 6 words password (as said, no need of capital letters, numbers, special characters or anything).

This is now your passphrase. Important note: do not reject a word because you do not like it, take what the dices are giving you. At the beginning, I would suggest you write it down to a paper and set it up as a passphrase that you will use everyday, like you master passphrase for Full disk encryption, or your password manager, or Thunderbird for example.

Then after one week or so, you should have memorized it, then you will burn the piece of paper.

diceware.txt · Last modified: by usera