Six Rolls and a Wordlist: The Low-Tech Comeback of Diceware Passphrases

There's a particular kind of irony in modern security: the most uncrackable password advice floating around right now involves a plastic cube you'd find in a Monopoly box.

Diceware — the practice of generating passphrases by rolling a six-sided die and looking up words in a numbered list — has been quietly making a comeback, and not just among the tin-foil-hat crowd. Regular folks in Omaha, Des Moines, and everywhere in between are discovering that five random words strung together beat just about any password generator app on both memorability and raw entropy.

Let's break down why, and then actually build a custom list together.

The Math Nobody Explains Properly

Every password's strength comes down to one number: entropy, measured in bits. Each bit of entropy doubles the search space an attacker has to cover.

A typical human password — your kid's name, a birthday, an exclamation point — might carry 20 bits of entropy. An eight-character random gibberish string from a password manager lands around 40 to 50 bits, depending on the character set.

Now the fun part. The classic Diceware wordlist contains 7,776 words (6⁵, one word per five-die roll). Each word you add contributes roughly 12.9 bits. A five-word passphrase? About 64.6 bits. That's stronger than most machine-generated passwords, and here's the kicker: you can actually remember it.

staple trombone kettle dusk marble is a nightmare for a cracking rig but perfectly recallable for a human brain. Randomness does the heavy lifting; your memory just has to hold five images.

Why Dice Beat Algorithms (Sometimes)

Password managers use cryptographically secure random number generators, and those are genuinely excellent. The case for Diceware isn't that algorithms are weak — it's about trust architecture.

When you roll physical dice, the randomness never touches a device. No keylogger can capture a die roll. No compromised generator app can log your entropy source. For people worried about supply-chain attacks or just uneasy about trusting a corporation's cloud vault with their entire digital life, a die and a printed list offer something rare: a security tool with zero attack surface.

There's also the durability angle. Your password manager goes down, you lose your phone, the subscription lapses — and suddenly you're locked out of everything. A passphrase lives in your head. It survives dead batteries and bankrupt startups.

That said, let's be honest about the tradeoffs. Typing a 30-character passphrase on a phone keyboard is annoying. Some sites cap password lengths. And if you pick the words yourself instead of rolling for them — hello, [correct horse battery staple](https://en.wikipedia.org/wiki/Xkcd) clones — you've destroyed the entropy. The dice aren't optional. They're the whole security model.

Building Your Own Diceware List

Here's where it gets interesting for wordlist nerds like us. The original Arnold Reinhold list from 1995 is fine, but you can do better — and tailoring a list is a genuinely fun weekend project.

Step 1: Pick your word count target. If your list has exactly 6⁵ = 7,776 entries, every five-roll sequence maps to exactly one word. If you want a bigger or smaller list, aim for a power of 6 (6⁴ = 1,296 for shorter passphrases, or build a 6⁶ = 46,656-entry list for 15.6 bits per word).

Step 2: Curate for your brain. The ideal Diceware word is short (3–5 letters), phonetically distinct, and easy to visualize. Avoid words that sound alike — write, right, and rite all mapping to different numbers is a recipe for a 2 a.m. lockout. Our wordlist generator lets you filter by length, exclude near-homophones, and strip out anything you'd stumble over.

Step 3: Run the entropy check. Plug your final list size into the formula: log₂(list size) × word count. Anything above 60 bits total puts you ahead of the vast majority of passwords in the wild.

Step 4: Assign numbers and roll. Number your words 11111 through 66666, print the list, and roll five dice per word. Five words minimum. Six if the account matters.

One pro tip: whatever you do, don't use a random word picker website to "roll" for you. That's just a password generator with worse UX and the same trust problem.

The Adoption Reality Check

According to data from the National Institute of Standards and Technology's guidance and various breach analyses, the average American still leans on passwords that can be guessed in seconds. Passphrases have gained real traction since the xkcd "correct horse battery staple" comic went mainstream over a decade ago, but adoption of properly random passphrases — the Diceware kind — remains niche.

Part of that is friction. Rolling dice feels weird the first time. But part of it is that most people have never had the entropy math explained without a statistics degree attached. Once you see that five dumb words outperform a 12-character symbol salad, the argument sells itself.

Security researchers have been saying for years that length beats complexity. Diceware is just the most honest implementation of that advice.

Try It This Week

Grab a die, fire up our wordlist generator, and build a list tuned to how you think. Roll out a six-word passphrase for your email account — the crown jewel of your digital identity — and see how it feels.

Worst case, you waste ten minutes. Best case, you've got a password that outlives every password manager subscription you'll ever pay for.