xkcdpass

What it is and what it does

xkcdpass is a command-line tool that generates strong passphrases by randomly combining words from a word list, inspired by the XKCD 936 comic. It ships with multiple built-in word lists (EFF-long, EFF-short, and variants in Spanish, Finnish, Italian, German, Norwegian, French, Portuguese, and Swedish) and supports custom word files. The tool is designed to produce memorable yet cryptographically strong passwords suitable for diceware-style passphrase generation.

The package offers fine-grained control over passphrase generation: you can specify word count, minimum and maximum word length, delimiter characters, case transformation rules (lower, upper, alternating, random, capitalize, as-is), and acrostic constraints to force the first letters to spell a chosen word. It runs as a standalone CLI with no external runtime dependencies, making it lightweight and easy to integrate into scripts or password workflows.

Use it for:

• Generate a memorable passphrase for a personal password manager or high-security account.
• Create multiple candidate passphrases interactively and select the one you prefer.
• Enforce passphrase structure (e.g., acrostic spelling, specific delimiters) for compliance or organizational standards.
• Integrate passphrase generation into shell scripts or automation workflows via command-line arguments.
• Use custom word lists in other languages or domains for domain-specific passphrase generation.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Generates strong, memorable passphrases by randomly selecting words from built-in or custom word lists, with options to constrain word length, add delimiters, apply case rules, and enforce acrostic patterns.

Yes. xkcdpass is a stable, dependency-free tool for generating strong passphrases with no security vulnerabilities on record. It is well-suited for anyone who prefers memorable multi-word passwords over random character strings. The aging maintenance status (215 days since last release) is not a blocker for a mature utility with no active bugs, but verify whether the project's pace aligns with your support expectations.

Install

xkcdpass on PyPI

pip install xkcdpass

uv add xkcdpass

poetry add xkcdpass

Installing xkcdpass

Before you install

Low friction: pure Python wheel with no runtime dependencies. Maintenance status is aging (last release 215 days ago, last commit 2026-01-24), but the package is marked Production/Stable and the repository remains active with 1431 stars.

License in practice

BSD-3-Clause is permissive and poses no restriction on commercial or private use. Word lists included carry mixed licenses (CC BY 3.0, public domain, GPL, BSD-3); the package documentation clarifies each list's provenance.

Quickstart

$ pip install xkcdpass
$ xkcdpass
> correct horse battery staple

Or with options:
$ xkcdpass --count=2 --numwords=4 --delimiter='-'
> word-word-word-word
> word-word-word-word

Requires Python 3.6 or later.

Verify before relying

• Whether the cryptographically secure RNG requirement is enforced by default or requires explicit opt-in beyond the --allow-weak-rng flag.
• Whether the package is actively maintained or in maintenance-only mode given the 215-day gap since last release.

Package facts

Evidence: xkcdpass-1.30.0-py3-none-any.whl

Tags

More Cryptography packages