Diceware makes passwords virtually unhackable by using physical dice to generate random, long, and memorable passphrases that resist brute-force attacks.
The system relies on a mathematical concept called entropy (a measure of randomness). Instead of a human guessing a password, physical dice rolls choose words completely at random from a master list. Because computers excel at guessing human patterns but struggle with true randomness, Diceware creates a barrier that even modern supercomputers cannot breach in a reasonable timeframe. The Core Mechanics of Diceware
To understand why Diceware is so secure, it helps to look at the math behind a standard 5-word passphrase. The Wordlist: The standard Diceware list contains exactly unique words.
The Generation: You roll a standard six-sided die 5 times to generate a 5-digit number (e.g., 2-4-1-5-3), which corresponds to one specific word on the list.
The Pool: Repeating this process 5 times creates a passphrase chosen from an astronomical number of possible combinations. The Entropy Math We calculate the total number of possible passphrases ( ) using the formula: N=LWcap N equals cap L to the cap W-th power is the number of words in the list ( is the number of words in your passphrase For a standard 5-word passphrase:
N=7,7765≈2.84×1019 combinationscap N equals 7 comma 776 to the fifth power is approximately equal to 2.84 cross 10 to the 19th power combinations To convert this into bits of entropy ( ), we use the base-2 logarithm:
E=log2(N)=log2(7,7765)≈64.6 bitscap E equals log base 2 of open paren cap N close paren equals log base 2 of open paren 7 comma 776 to the fifth power close paren is approximately equal to 64.6 bits Each added word contributes exactly bits of entropy. Passphrase Strength Comparison Passphrase Length Total Combinations Entropy (Bits) Security Level 4 Words ≈51.7is approximately equal to 51.7 Weak (Vulnerable to targeted arrays) 5 Words ≈64.6is approximately equal to 64.6 Moderate (Safe from casual cracking) 6 Words ≈77.5is approximately equal to 77.5 Strong (Secure against state-level actors) 7 Words ≈90.4is approximately equal to 90.4 Unbreakable (Safe for decades to come) Why “Unhackable” is Mathematically Accurate
When security experts call a 7-word Diceware passphrase “unhackable,” they are referring to the laws of physics and time.
If a hypothetical supercomputer cluster could test 1 trillion ( 101210 to the 12th power ) passwords per second, we can calculate the time ( ) required to brute-force a 7-word passphrase:
T=1.72×1027 combinations1012 guesses/sec=1.72×1015 secondscap T equals the fraction with numerator 1.72 cross 10 to the 27th power combinations and denominator 10 to the 12th power guesses/sec end-fraction equals 1.72 cross 10 to the 15th power seconds Converting this into years:
Tyears=1.72×1015365.25×24×3600≈54,500,000 yearscap T sub years end-sub equals the fraction with numerator 1.72 cross 10 to the 15th power and denominator 365.25 cross 24 cross 3600 end-fraction is approximately equal to 54 comma 500 comma 000 years
Even if guessing speeds increase exponentially, a 7-word or 8-word passphrase remains entirely out of reach for brute-force software. The Human Advantage
Diceware solves the fundamental flaw of human password creation: predictability.
Human Habits: Humans tend to pick words, names, dates, or keyboard patterns (like “qwerty”) that password-cracking software explicitly targets using “dictionary attacks.”
Memory Optimization: While a computer-generated random string like 9#mK!z$2P is hard to remember, a Diceware phrase like snort shadow tilt visual memory forms a mental image that is easy for a human brain to retain, while remaining completely unpredictable to a machine. ✅ Summary of Diceware Security
Diceware achieves its “unhackable” status by removing human bias from password generation and relying on the mathematical certainty of large combinations. By rolling a physical die to select words from a 7,776-word list, you create a passphrase with enough entropy to resist brute-force attacks for millions of years.
If you would like, I can walk you through how to generate your own passphrase safely, explain the difference between electronic vs. physical dice, or give you tips on how to memorize a long sequence of words. Diceware & Passwords – Computerphile
How do you pick a secure password that’s memorable but truly random? Dr Mike Pound explains Diceware The Diceware website: http:// YouTube·Computerphile Diceware & Passwords – Computerphile
How do you pick a secure password that’s memorable but truly random? Dr Mike Pound explains Diceware The Diceware website: http:// YouTube·Computerphile