Passphrase Entropy (Diceware and Word Lists)

The arithmetic is identical to the character version, with words in place of characters: $w$ draws from a list of $D$ gives $w\log_2 D$ bits. What changes is the size of the alphabet. Diceware's standard list holds 7776 words, which is $6^5$ — one word per roll of five ordinary dice — so each word is worth exactly $5\log_2 6 = 12.925$ bits. A character over the full printable ASCII set is worth 6.57. So one Diceware word carries about as much as two random characters, and it is enormously easier to remember, type on a phone, and read aloud over a phone line.

The dice are not decoration. Arnold Reinhold designed Diceware around physical dice in 1995 for a specific reason: a person asked to choose "random" words does not, and the words they choose are correlated in ways an attacker can model. Rolling five dice and looking up the number gives a genuinely uniform draw, and it is the only step in the whole procedure that produces the entropy. A generator that draws uniformly from the same list is equally good. Picking six words that feel unrelated is not, and the resulting phrase has an entropy nobody can compute — the same problem as a human-chosen password, in longer form.

Some landmarks on the standard 7776-word list: four words is 51.7 bits, five is 64.6, six is 77.5, seven is 90.5, eight is 103.4. The current common recommendation is six words for a passphrase that has to survive an offline attack on a stolen hash, and four or five where a rate-limited service stands between the attacker and the guess. The xkcd construction is four words from a smaller list of about 2048, which is 44 bits: excellent against a login form that locks after five tries, thin against a leaked password database.

Three things people add to passphrases that are worth less than they look. Capitalisation of the first letter of each word adds nothing at all if the attacker knows the convention, and one bit per word if it is genuinely random — which nobody's fingers can sustain. Separators — hyphens, spaces, dots — add nothing unless the choice among them is random, in which case they add $\log_2$ of the number of separators you might have used, which is about two bits for the whole phrase. A trailing digit adds 3.3 bits. Against 12.9 bits for one more word, the ranking is not close. Draw another word.

The one real caution is Kerckhoffs's principle, and it is not a technicality: assume the attacker knows the list, the word count, the separator scheme and the capitalisation rule. The strength has to live entirely in the dice rolls, because everything else is public or guessable. A cracker configured for "six Diceware words joined by hyphens" is a search over $7776^6$ and nothing more, and that is precisely the number this page reports. If your scheme relies on the attacker not knowing the scheme, the number above is not the strength — it is the strength you would have had.