Readable tokens exist because some credentials have to survive human contact — read over a phone, typed from a printed sheet, or dictated in a support call. They trade density for recall, and the trade is real: a readable token needs to be much longer than a random one to reach the same strength.
The arithmetic
Each dictionary word from an 86-word list contributes about 6.4 bits. Each invented syllable contributes about 13.5 bits, because it combines an onset, a nucleus and a coda drawn independently.
| Segments | Words (~6.4 bits each) | Syllables (~13.5 bits each) |
|---|---|---|
| 4 | 26 bits | 54 bits |
| 6 | 39 bits | 81 bits |
| 8 | 51 bits | 108 bits |
| 10 | 64 bits | 135 bits |
| 12 | 77 bits | 162 bits |
Five words is around 32 bits. That is not a credential; it is a guessable phrase. Real Diceware achieves its strength from a 7,776-word list at 12.9 bits per word, and even then recommends six words minimum. With a short list you need many more segments.
The rule: read the entropy readout, not the word count. If it is under 96 bits, this token is not suitable for authenticating anything.
Where readable tokens are the right choice
- Recovery codes printed and stored offline, where transcription accuracy matters more than length.
- Pairing codes read aloud during device setup, protected by a short validity window and attempt limits.
- Human-facing identifiers — a deployment name, a test tenant — where the value is not secret at all and readability is the only goal.
Where they are the wrong choice
Anything a machine handles. An API key does not need to be memorable; it needs to be short enough to fit in a header and strong enough that nobody guesses it. Use the random key generator instead, and get 256 bits in 43 characters rather than 135 bits in 60.
Separators and capitalisation
Neither adds meaningful entropy. A hyphen separator adds nothing at all if the attacker knows the format, and capitalising the first letter of each word adds nothing if it is applied uniformly. They are readability choices, and the entropy readout correctly excludes them.
Trailing digits do add entropy — 3.32 bits each — but they also break the readability that motivated the format in the first place. Adding one more word is usually the better trade.
Frequently asked questions
How many words do I need for a secure token?
At roughly 6.4 bits per word from this list, you need about 15 words to reach 96 bits. That is impractical. If you need real strength and readability, use the two-syllable mode — eight segments gets you to 108 bits in a much shorter string.
Is a passphrase stronger than a random password?
Only when it is long enough. A well-chosen passphrase from a large list can be both strong and memorable, which is why Diceware works. A short phrase from a small list is neither. The maths, not the format, decides.
Should I use this for user passwords?
It is a reasonable generator for a suggested password, provided you show enough segments. But user passwords should be protected by a slow hash regardless — see PBKDF2 key derivation — because you cannot force users to accept a generated value.
Why is the word list small?
It is a curated list chosen for unambiguous spelling and pronunciation, which is what makes the tokens readable. The trade-off is fewer bits per word, and the entropy readout states that honestly rather than quoting Diceware's numbers for a list that is not Diceware.