Passy Pie
Passwords you can picture.
🇬🇧
AI
#
Choose your strength
Your password

Keep hitting Generate until you find a phrase you love, then:

How it works

1

Random words

Words are picked from curated lists using a cryptographically secure random generator. No patterns, no predictability.

2

AI polish

An AI arranges those raw words into a proper sentence, adding prepositions, articles and a special character. Word soup becomes a vivid scene.

3

Picture it

An AI generates a unique illustration of your passphrase. Your brain stores images far more effectively than strings of text.

4

Remember it

Study the picture for ten seconds. Close it. When you need the password, recall the scene and the words come flooding back.

Why pictures beat passwords

Cognitive scientists call it the picture superiority effect. Read a word and you have roughly a 10% chance of recalling it three days later. See an image and that jumps to 65%. By pairing a passphrase with a matching illustration you engage two memory systems at once: verbal and visual. This is dual coding theory, first proposed by Allan Paivio in 1971 and one of the most replicated findings in memory research.

"Frozen Merlin throws an anvil!" is almost impossible to forget once you have seen a cartoon of it happening. Your brain stores a scene, a story, a moment. The words are just labels for something you can already picture.

The maths behind it

Password strength is measured in bits of entropy: how many guesses an attacker would need if they knew exactly how the password was generated. Each bit doubles the difficulty.

When the AI polishes a phrase it adds unpredictable structural decisions: which article? which preposition? where does the symbol land? singular or plural? These compound to add roughly 10 to 15 extra bits on top of the random word selection.

PasswordEntropyVerdict
Password1~10 bitsCracked instantly
Fluffy2019!~18 bitsSeconds
Tr0ub4dor&3~28 bitsHours
The Crimson Owl?~27 bitsHours (but memorable)
Merlin throws anvils!~42 bitsWeeks to months
Tiny Zeus juggles cacti!~53 bitsYears

The key insight: a memorable phrase you can actually recall is infinitely more secure than a complex password scribbled on a sticky note.

🔒 Privacy and security

Passy Pie is designed so that nobody, including us, ever knows your password.

  • Custom words are sanitised server-side, stripping anything that isn't a letter, number, or hyphen. This prevents code injection, XSS, and prompt injection attacks.
  • Your passphrase is never stored on our server, in any database, or in any log file.
  • The generated image is never saved. It is created, sent to your browser, and discarded.
  • API calls to the AI providers are made with storage disabled (OpenAI: store: false). Neither provider retains your prompt or the generated output for training or logging.
  • The word selection happens using your server's cryptographically secure random number generator (secrets module), not a predictable pseudo-random source.
  • Nothing is cached in the service worker except the static page shell. Password data never touches the cache.

In short: once you close the page, the password and image exist only in your memory (and your clipboard, if you copied them).

About the word lists

The words are derived from the EFF Large Diceware Wordlist, a carefully curated set of 7,776 common English words published by the Electronic Frontier Foundation. They have been sorted into categories (nouns, verbs, adjectives, colours, locations) and supplemented with historical figures, mythological characters, and public-domain fictional characters. No living people are included.

The word lists (wordlists.json), the AI prompt (prompt.txt), and the app configuration (config.json) all live in separate files so they can be expanded or tweaked at any time without touching code.

Claude
OpenAI