How Strong Is VERNAM’s Passphrase Generator?

Updated

VERNAM’s built-in generator draws six random words from the 2,048-word BIP39 list, producing roughly 66 bits of entropy. That is strong enough to resist brute-force guessing for file encryption, and the six-word format is practical to write down or memorize. The catch is that the passphrase is the only key: VERNAM does not store it, so if you lose it, the file cannot be recovered.

What the generator actually does

When you tap the dice icon on the VERNAM page, the tool selects six words at random from the BIP39 wordlist—the same 2,048-word list used for crypto wallet seed phrases. Each word contributes 11 bits of entropy (log₂ 2048 = 11), so six words give 66 bits total.

The page describes this as “strong enough to shrug off any brute-force attack, yet simple to write down or remember.” That trade-off is the design goal: a passphrase you can transcribe onto paper without errors, rather than a random character string you might mistype.

Why 66 bits is adequate here

The passphrase is not used directly as the encryption key. VERNAM stretches it into a 256-bit key with Argon2id, the memory-hard key-derivation function designed to make password cracking expensive. In standard mode the page describes “standard protection, plenty for most files.” High security mode increases the cost of each guess with heavier key derivation—256 MiB of memory and 3 passes—and the page notes it is “not recommended for low-RAM devices.”

So the effective security is the combination of 66 bits of passphrase entropy and the per-guess cost imposed by Argon2id. An attacker cannot cheaply test candidate passphrases; each attempt requires significant memory and computation.

How to use and store the passphrase

  1. Tap the dice to generate six words.
  2. Write the words down exactly, in order, before encrypting. The page warns: “Enter the exact passphrase this file was encrypted with. It is the only key, never stored anywhere.”
  3. Encrypt the file. Everything happens in your browser; the page states your files and password “never touch a server.”
  4. Store the written passphrase somewhere separate from the encrypted file—for example, a password manager entry or a physical note kept apart from the file’s location.

Common pitfalls

  • Assuming recovery exists. A wrong passphrase simply fails, and the page states “there is no recovery.” There is no account, no server-side copy, and no reset.
  • Retyping from memory at decryption time. Word order and spelling must match exactly. Keeping the written copy avoids transcription errors.
  • Using high security mode on a low-memory device. The page explicitly cautions against this; the heavier key derivation can be slow or fail on constrained hardware.
  • Confusing the generator with storage. Generating a strong passphrase does not save it anywhere. The strength only helps if you preserve the exact words.

What this means for your decision

If you want a passphrase you can back up on paper and still trust against offline guessing, the six-word BIP39 output is a reasonable choice, especially combined with Argon2id key stretching. If your threat model demands more margin, you can supply your own longer passphrase instead of using the generator—VERNAM accepts a passphrase you set yourself. Either way, plan your backup before you encrypt, because the passphrase is the only way back into the file.