Everybody knows XKCD 936.
Almost nobody actually uses it.
We quote the comic in meetings. We nod wisely about entropy. Then some registration form demands an uppercase letter, a number, a symbol, and a blood oath, so we type Summer2026! and call it a day.
I got tired of watching that happen. So I built CorrectStaple.
Yes, the domain is a joke. The math is not.
The comic was right. The signup forms were not.
The XKCD punchline is simple: four random common words beat a short mangled password that humans forget and GPUs do not.
correct horse battery staple is easy to picture and hard to brute force.
Tr0ub4dor&3 is hard to remember and still somehow easy for a cracking rig that has seen every o→0 substitution since 2009.
The catch is that the real internet did not get the memo. A shocking number of sites still want digits and punctuation like it is 2004 and password policy is a personality. Pure four-word classic XKCD fails those forms. Pure complexity theater fails your brain.
CorrectStaple lives in the uncomfortable middle: memorable words, cryptographic randomness, and just enough numbers and symbols to get past the bouncer.
What it actually does
CorrectStaple generates passphrases from the EFF large wordlist (7,776 words) using your browser’s own CSPRNG. Nothing phones home. Nothing needs an account. If the tab is closed, the session history is gone.
The default is roughly “modern site that still has opinions”:
- four random words
- a couple of digits
- one special character
- enough entropy that “Summer plus year plus bang” should feel embarrassed
You also get presets for the full spectrum of institutional nonsense:
- XKCD Classic when you want the comic, uncut
- Standard Web when the form has feelings
- Strict Legacy Site when some ancient portal caps you at twenty characters and still demands complexity like a tiny tyrant
- Master Vault Key when you are generating something that should outlive the laptop
Features I added because I am like this
A passphrase tool can stop at “generate and copy.” Mine did not, because once you start solving your own annoyances you keep going.
Privacy blur. Hit B and the passphrase softens so shoulder-surfers get modern art instead of your new vault key.
Clear on tab hide. Switch away and the sensitive bits can disappear with you.
Clipboard scrub. Copy, paste, then let the clipboard forget it after thirty seconds like a professional adult.
NATO phonetics. Because reading Skirmish over a phone call as “S as in… wait” is a failure mode I have lived.
QR code. Generate on the desktop, scan on the phone, avoid the sacred ritual of emailing yourself a password.
Mental picture stories. The words become a tiny scene so your brain has something to hang onto besides vibes.
Physical Diceware mode. Roll real dice, click the faces, stay air-gapped in the most theatrical way possible. Extremely normal behavior. Do not make eye contact with coworkers while doing this.
Strength comparator. Drop in a sample pattern like Tr0ub4dor&3 (not a live password, please) and watch it sit next to a real dictionary-based passphrase like a cautionary tale with a scoreboard.
There is also a printable recovery kit, bulk export, and enough knobs for separators, capitalization, and length limits that you can satisfy nearly any policy document written by someone who has never had to remember their own rules.
Why offline matters
If your password generator needs the cloud, congratulations: you have invented a very polite way to outsource the most sensitive string in your life.
CorrectStaple runs locally. The randomness comes from crypto.getRandomValues. The wordlist is on the page. The history lives in RAM until the tab closes. That is the whole trust model, and I like it that way.
I already had a miniature version of this idea on my e-reader in CrossPlay’s KEYS app. CorrectStaple is the browser-sized sibling: more options, better UX for day-to-day signup forms, same refusal to pretend P@ssw0rd1 is a personality.
The point
Passwords are a human problem dressed up as a machine problem.
Machines are great at grinding through predictable patterns. Humans are great at remembering little stories and terrible at remembering whether the third character was a zero or an O. XKCD noticed. CorrectStaple just tries to make the good advice usable on the actual internet, including the parts of the internet that still think an exclamation point is a security control.
So if you are about to invent another seasonal password, stop. Open correctstaple.com, hit space, and get four words that can survive both a GPU and your own memory.
Then write them down somewhere that is not a sticky note on the monitor. I can only help so much.