Memorable.
Uncrackable.

A 4-word passphrase from a 1,000-word list has 1,000⁴ = 1 trillion possible combinations. A random 8-character password has far fewer, especially if it uses common substitutions.

Most modern services accept passphrases. A few older systems limit length or disallow spaces — use a hyphen or dot separator in those cases.

Yes. Words are selected using crypto.getRandomValues() — the same cryptographic API used by security professionals. Nothing is predictable.

A famous XKCD comic (936) demonstrated that four random words are both easier to remember and harder to crack than a "clever" password like Tr0ub4dor&3. PassLab implements exactly this idea.

Four words is a strong default for most accounts. For high-value targets like your primary email or password manager, use five or six words to add extra entropy.

It's not strictly necessary — the strength comes from random word selection. However, sprinkling in a digit or symbol between words can satisfy strict site requirements without hurting memorability.

No. Everything runs in your browser using client-side JavaScript. No passphrase, word list selection, or configuration ever leaves your device.