XKCD Password Generator

1.30.0 · active · verified Fri Apr 17

xkcdpass is a Python library that generates secure multiword passwords or passphrases inspired by the XKCD comic 'Password Strength'. It provides tools to create memorable yet strong passphrases using various wordlists and configuration options. The library is actively maintained with a consistent release cadence, with the current version being 1.30.0.

Common errors

```
ModuleNotFoundError: No module named 'xkcdpass'
```
cause The xkcdpass library is not installed in your current Python environment.

fix Run `pip install xkcdpass` to install the library.
```
AttributeError: module 'xkcdpass' has no attribute 'generate_xkcdpassword'
```
cause You likely imported `xkcdpass` directly instead of its submodule `xkcd_password`, where the core functions reside.

fix Change your import statement to `import xkcdpass.xkcd_password as xp` and then call functions like `xp.generate_xkcdpassword()`.
```
FileNotFoundError: [Errno 2] No such file or directory: '<path_to_your_wordlist>'
```
cause The path provided to `generate_wordlist` or `locate_wordlist` does not point to an existing wordlist file.

fix Ensure the path to your custom wordlist is correct and the file exists. If using the bundled wordlist, ensure `xp.locate_wordlist()` is called correctly and that the library was installed properly to include its data files.

Warnings

breaking The default separator character for `generate_xkcdpassword` changed from a space (' ') to a hyphen ('-') in version 1.0.0.
Fix: If your application relies on the old default, explicitly specify `separator=' '` when calling `generate_xkcdpassword()`.
gotcha Using a small or unsecure wordlist (e.g., custom wordlists with few unique words, or dictionary words easily guessable) significantly compromises the security of generated passphrases.
Fix: Always use a robust wordlist, ideally the bundled one via `xp.locate_wordlist()` or a carefully curated, large custom list. Ensure `numwords` is sufficiently high (e.g., 4 or more) to maintain entropy.
gotcha The `generate_wordlist` function returns a `list` of words, not a `set` (which was the case in some older implementations/examples).
Fix: If you relied on set-specific operations (like fast `in` checks or automatic deduplication from a list converted to a set), be aware that this behavior changed. For unique words, the generation process already handles this, but type-specific operations might need adjustment.

Install

pip install xkcdpass Install latest version

Imports

xkcd_password
wrong:
```
import xkcdpass
```
correct:
```
import xkcdpass.xkcd_password as xp
```
The primary functions are within the `xkcd_password` submodule, so it's best to import it directly, often aliased as `xp`.

Quickstart

This quickstart demonstrates how to generate a strong, memorable passphrase using the bundled wordlist. It first locates the wordlist, processes it to meet specific length criteria, and then generates a 4-word passphrase using a hyphen as a separator.

import xkcdpass.xkcd_password as xp

# Locate the default bundled wordlist
wordlist_path = xp.locate_wordlist()

# Generate a wordlist from the file
# You can also specify language or min/max word length here
wordlist = xp.generate_wordlist(wordlist=wordlist_path, min_length=5, max_length=8)

# Generate a passphrase with 4 words and a hyphen separator
passphrase = xp.generate_xkcdpassword(wordlist, numwords=4, separator='-')
print(f"Generated Passphrase: {passphrase}")

view raw JSON →