27/05/2026 · 40
Here are the three best techniques for generating a strong password:
It involves randomly choosing several unrelated words and numbers:
horse-paperclip-sun-42-banana-table-20-coffee
Long, easy to remember, and extremely difficult to crack (do not include hyphens between the words). Note that the choice of words must be truly random. The Diceware method uses dice.
How does it work?
Diceware relies on an official word list (the "Diceware wordlist" – https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) containing 7,776 words numbered from 11111 to 66666.
Why 7,776 words?
A die has 6 sides (1 to 6). If you roll 5 dice, the total number of possible combinations is:
6 × 6 × 6 × 6 × 6 = 6⁵ = 7,776
So, the list contains exactly 7,776 words—one for every possible 5-dice combination.
Why numbered from 11111 to 66666?
Because dice range from 1 to 6, never from 0 to 5. Therefore:
The lowest possible result with 5 dice → 1-1-1-1-1 = 11111
The highest possible result with 5 dice → 6-6-6-6-6 = 66666
Numbers containing a 0, 7, 8, or 9 simply do not exist in the list, because a die cannot produce those digits. You roll 5 dice, and the result gives you a word:
Dice roll
Word corresponding to 1-2-3-4-5 = abrupt
Word corresponding to 2-4-1-3-6 = cheval
Word corresponding to 3-3-1-5-2 = soleil
You repeat the process at least 6 times to obtain your passphrase.
Why is it so secure?
It’s a matter of math:
1 word = 7,776 possibilities
5 words = 7,776⁵ = 28 trillion combinations
6 words = 7,776⁶ = 221 quadrillion combinations
Even with a very powerful computer making 1 billion attempts per second, cracking a 6-word passphrase would take millions of years.
Take the longest possible sentence and keep the first letters + numbers + symbols:
"J'ai 2 chats et 1 chien depuis 2020, ils sont mes 3 amours !" (I've had 2 cats and 1 dog since 2020; they are my 3 loves!)
→ J’a2ce1cd2,ism3a!
Use a password manager to generate something like:
Xk#9mP!2vQ/w$7nLz
This is the most secure method but the hardest to memorize.
The golden rules
• Minimum 16 characters
• Mix uppercase, lowercase, numbers, and symbols
• Never use standalone dictionary words
• Never use personal info (date of birth, first name, etc.)
• One unique password per site/service
Recommended tool
• KeePassXC — local, open source, no cloud data. Desktop and smartphone versions for all operating systems (iOS, Android, macOS, Windows, Linux)
In short, the Diceware method is ideal for passwords you need to memorize (like the passphrase for your GPG private key 😉), while random generation via a manager is best for everything else.