The Password Generator's Word List: 2,565 Words, No Duplicates, and No Words Starting With X

I work on OnePassApps, the team behind app.onepassapps.com.

The Password Generator's passphrase mode draws its words from a list of 2,565 words that ships inside the app's own JavaScript. We have covered this route twice before - the strength estimate, measured bit by bit for the password side and the maths behind the bits reading, and which one to copy and why the bit count differs for the two modes side by side.

Both of those posts stop at the number 2,565. This one opens the list.

Everything below was measured on 9 November 2026. The list was read out of the chunk the site actually serves, /assets/PasswordGenerator-DQ2Pm6Gs.js (29,345 bytes), fetched over plain HTTPS with no session and no cookies. The duplicate-word count was measured in the visible browser tab, not inferred.

Where the list lives

The words are not in a text file the app downloads. They are one string literal inside the app's own JavaScript chunk, split on whitespace and frozen: 15,988 characters, 2,565 words after the split.

During the measured session the page made 107 network responses. Not one of them was a word list, and the only response whose URL mentions passwords was the app's own chunk. No request carried a request body.

So the list travels to the reader inside the code that uses it, and the count on screen comes from the same array the estimate is computed from.

The shape of it

2,565 words, every one of them lowercase a to z.
Not one word appears twice.
The list is in alphabetical order, from abacus to zucchini.
Word lengths run from 3 to 8 letters: 151 words of 3 letters, 623 of 4, 815 of 5, 626 of 6, 260 of 7 and 90 of 8.

The one letter it never starts with

Twenty-five of the twenty-six letters open a word. The letter s opens the most, with 316 words, then c with 247 and p with 191. The thinnest are q with 15 words, z with 15, y with 17 and u with 22.

The letter x opens nothing at all, and it is the only letter that does not. Thirty words carry it inside instead: apex axis box elixir exact exam example exhale exit expand expert extra, fix fox foxglove galaxy inbox index lynx mix next onyx oxford oxygen and pixel relax six taxi text wax.

Two spellings in one list

Most of the list is British English. colour, favour, centre, armour and flavour are all in it, and the American spellings color, favor, center, armor and flavor are all absent.

But the same list carries meter and not metre, so the everyday words are British and the length unit is not. The interface follows the list: the switch is Capitalise words, not Capitalize words.

With replacement, measured

The app's own line says the words are chosen at random with replacement. That is the part that changes what you get: the same word can come up twice inside one passphrase, so a 12-word passphrase is not necessarily 12 distinct words.

Measured: 300 generations at the 12-word maximum. Eight of the 300 came back with a repeated word. One of them was capstan-six-bonfire-mainsail-vine-ice-show-fountain-ice-rattle-plough-canyon, where ice appears twice.

The chance of at least one repeat in 12 draws from 2,565 is about 2.54 percent, so 7.6 of the 300 expected and 8 observed. The generator is behaving exactly as the arithmetic says.

It does not make the passphrase weaker. The estimate is a property of the settings, not of the text: An estimate from how this result was generated (its settings), not from the text itself. It assumes an attacker knows the settings. The number of possible strings does not change when a word repeats.

What a repeat changes is the look of it. A passphrase that says the same word twice reads like a smaller one. That is a fair complaint about the display, not about the security.

Limits

These figures are the build the site served on 9 November 2026, read from the shipped chunk, and one signed-out browser session on one machine. The list is the app's own original list, so its size and spelling are a product decision rather than a standard. The 56-bit reading quoted here is the app's own default passphrase estimate at five words, which it prints as Result generated, 56 bits (estimate).