Three Random Words Generator
Create a password from three random words — the method recommended by the UK’s National Cyber Security Centre. Memorable, typeable, and genuinely random.
Click to copy
“Use three random words” is the password advice the UK’s National Cyber Security Centre gives the public, and it works because it replaces the thing that fails — human imagination — with randomness. A password like RainCopperViolin is long, has no personal meaning to research, and sits nowhere in the pattern lists crackers try first; yet it survives in memory the way k9P$wq2Zmf never will.
The catch is the word random. Three words you think of are not random — people reach for connected ideas (pets, places, hobbies) that shrink the search space dramatically. This generator draws each word from a 7,776-word list using your browser’s crypto.getRandomValues(), so the selection is cryptographically uniform. Three words carry about 39 bits of entropy — ample for online accounts that rate-limit guessing — and the optional number and symbol add roughly 10 more. For high-value accounts, or anything an attacker might crack offline, step up to four or five words with one click, or use a fully random password stored in a manager.
Everything happens locally in your browser: no word, password, or setting is transmitted, logged, or stored. Generate as many as you like and keep the one that sticks.
Frequently Asked Questions
What is the three random words method?
It is password advice from the UK’s National Cyber Security Centre (NCSC): combine three unrelated, randomly chosen words — like RainCopperViolin — into one password. The result is long, easy to remember and type, and far harder to guess than an invented "complex" password built from a name and some substitutions.
Why does the NCSC recommend three random words?
Because it fixes the real failure mode: predictability. People asked for "complex" passwords produce Pa$$w0rd1-style patterns that crackers try first. Three genuinely random words produce length and unpredictability while staying memorable, so people actually use different ones per account instead of reusing one clever password everywhere.
Is three words really enough?
For online accounts protected by rate limiting and lockouts, yes — three words from a 7,776-word list give about 39 bits of entropy, and an appended number and symbol push it near 49, far beyond what online guessing can reach. Against offline cracking of a leaked database the margin is thinner, so for high-value accounts click up to four or five words, or use a random character password stored in a manager.
What does a three-random-word password look like?
Something like BasketThunderLime42! — three unrelated words, capitalized so the boundaries are visible, with an optional number and symbol to satisfy composition rules. The generator above builds one from a 7,776-word list using your browser’s cryptographic randomness, which is what makes it genuinely random rather than three words you thought of.
How is this different from a passphrase?
Same idea, different tuning. A diceware passphrase uses five or six lowercase words with separators — maximum strength, typed from memory rarely. Three random words is the compact everyday version: shorter, no separators to remember, capitalized word boundaries, easy to type on a phone. Use the passphrase generator when you want the stronger form.
Should I add numbers or symbols to my three words?
Add them when a site requires them — the options above append a two-digit number and a common symbol, adding about 10 bits of entropy. The bigger lever is a fourth word (about 13 bits). Either way, let the generator choose randomly rather than appending your birth year, which attackers try immediately.
More tools
Written & reviewed by Andrew Ivanov, Fractional CTO. Last reviewed .