Diceware Explained: Origins, Security, and How to Roll Your Own Passphrase

Diceware remains one of the clearest examples of usable security done right. Instead of asking people to invent clever passwords, it asks them to select random words from a fixed list.

That simple shift, from creativity to randomness, is exactly why Diceware still holds up so well.

Where Diceware Comes From

Diceware was designed by Arnold G. Reinhold as a practical method for creating memorable, high-entropy passphrases with physical dice and a numbered wordlist.

The underlying idea is straightforward: if the words are selected randomly, a handful of ordinary words can form a very strong secret.

Why It Works

The security of Diceware comes from genuine randomness, not from poetic wording or hidden meaning. Each additional word adds another chunk of entropy.

A well-generated 5- or 6-word passphrase can be both memorable and highly resistant to guessing, especially compared with the short "complex" passwords many people still improvise.

How to Roll Your Own Passphrase

1. Take five standard six-sided dice, or roll one die five times for each word.
2. Write down the five-digit result, such as 43126.
3. Look up that number in an English wordlist—for example the EFF large wordlist (.txt)—and record the matching word.
4. Repeat the process until you have the number of words you want.
5. Keep the words in the exact order they were rolled.

Why the Wordlist Size Matters

A proper Diceware wordlist contains exactly 7,776 words—that is 6⁵, one entry for every possible five-dice roll. With that many words, each roll adds about 12.9 bits of entropy. Five words gives roughly 64 bits; six words gives roughly 77 bits, well beyond what current attackers can crack offline at any reasonable cost.

Shorter lists silently break that guarantee. A list of 1,000 words drops each roll to only 10 bits, so a five-word passphrase becomes no stronger than a mediocre random password—even though it looks like a Diceware passphrase.

When rolling manually, use a list you can verify. The following are well-known 7,776-entry lists that meet the standard:

• EFF large wordlist (.txt) — English, 7,776 words, by the Electronic Frontier Foundation
• diceware-fr-alt (.txt) — French, 7,776 words, by Arthur Pons (MIT licence)
• wordlist_de (.txt) — German, 7,776 words, from the ulif/diceware project
• wordlist_es (.txt) — Spanish, 7,776 words, from the ulif/diceware project (adapted)

How Many Words Should You Use?

• 4 words: acceptable only for lower-value use cases
• 5 words: a strong modern baseline
• 6 words: the best default for important passphrases
• 7 or more words: extra margin if you do not mind additional length

Manual Dice vs Digital Generation

Physical dice are ideal when you want a fully transparent offline process. They are slower, but easy to audit and easy to explain.

A local in-browser passphrase generator is far more convenient for everyday use, especially when it relies on fixed wordlists and cryptographically secure randomness.

Note: our passphrase generator currently supports 4 languages.

Try the Diceware Manual Roller

If you want the lookup done for you without giving up the manual process, try the Diceware Manual Roller on passwords.lu. Roll your dice, type each five-digit code, and the tool instantly looks up the matching word — entirely in your browser with nothing sent to any server.

It supports all four wordlists — English, French, German, and Spanish — so you can work in your native language. You can also use the built-in dice simulator for practice, then switch to physical dice when it counts.

Should You Download the Wordlists?

Yes—and the language you choose matters more than most people realise. A word you already know is far easier to remember than a foreign one. If your native language is not English, using a wordlist in your own language makes the passphrase genuinely memorable, not just technically strong.

Download the wordlist for your language, keep it somewhere safe, and use it when you want a passphrase you have generated and verified yourself.

Best Practices

• Use Diceware for secrets you actually need to remember.
• Use a password manager for everything else.
• Do not "improve" the result by turning it into a meaningful sentence.
• Pair important accounts with MFA.
• If you write the passphrase down temporarily, store it carefully and remove the note when you no longer need it.