What is a pronounceable password?
A pronounceable password alternates consonants and vowels to form syllables, producing invented words such as Trabolesk or Vimaroduzen. They are not in any dictionary, but your brain can “hear” them, which makes them much easier to remember and type than x8$Qm!z2. The approach dates back to the U.S. government’s FIPS 181 standard and the classic pwgen and apg utilities on Linux.
How strong are pronounceable passwords?
Because syllables follow rules, each letter carries less entropy than a fully random character — roughly 3 to 4 bits instead of 6.5. The tool calculates this conservatively and shows it in the meter. In practice:
- 12 letters + 2 digits ≈ 45–50 bits: fine for accounts with lockout and 2FA.
- 16 letters + 2 digits ≈ 60 bits: good everyday strength.
- 20+ letters: for anything that might face offline cracking.
Mixing in a capital letter at a random position and a symbol adds a few more bits. If you need maximum strength for a memorised secret, a passphrase of real words is stronger per unit of memory effort.
When pronounceable passwords shine
- Help desks and IT support reading a password to a user over the phone.
- Shared family or office devices where people type the password often.
- Children’s accounts — kids remember invented words surprisingly well.
- Typing on phones and TVs, where switching keyboards for symbols is slow.
How the generator works
Each syllable is a consonant (or a common cluster like br, st, th) followed by a vowel, sometimes closed by another consonant. Every choice uses the browser’s cryptographic random generator. Letters q, w, x and y are left out to keep the result easy to spell in most languages.
Last updated: · Reviewed by the Password Generator team