Passphrase format and strength

Every passphrase CP Word List generates has the same shape: three lowercase words joined by dashes, like apple-red-truck. Nothing about that shape is configurable — the same generator produces both live enrollment passphrases and the ones in a bulk export.

The format

Property	Value
Words per passphrase	3, always
Separator	A single dash (-)
Word length	3–5 letters
Total length	11–17 characters, including the two dashes
Character set	Lowercase a–z and - only
Word source	The EFF short word list, minus entries containing hyphens — 1,294 words
Randomness	Cryptographically secure (crypto.getRandomValues)

Words are chosen independently, so a passphrase may repeat a word.

Strength

Three words drawn from 1,294 give 2,166,720,184 combinations — roughly 2.17 billion, or about 31 bits of entropy.

Two things are worth knowing about what that means in practice:

• Length is never the problem. The shortest possible passphrase is 11 characters (art-aim-cub), comfortably above the 8-character minimum a WPA2 pre-shared key requires.
• It is a deliberate memorability trade-off. A random Cloudpath DPSK packs more entropy into fewer characters. CP Word List trades some of that for a passphrase a resident can read off a screen and type on a phone. The protection that matters most is still Cloudpath’s: each DPSK is unique per unit or user, and its device limit caps how many devices can ever use it.

Note

Because words are lowercase letters only, a passphrase is unambiguous to read aloud or copy from a printed sheet — no case, digits, or symbols to confuse.

Collisions

If a generated phrase happens to match a passphrase already in the Cloudpath DPSK pool, the update fails and the service generates a new phrase and tries again, up to 3 attempts. At 2.17 billion combinations this is rare. If all three collide, the webhook returns 409 and the enrollment keeps its original Cloudpath passphrase, which is still valid.

What you cannot change

These are fixed properties of the service, not settings:

• The number of words is always three. There is no four-word or longer mode.
• The word list is built into the service. You cannot upload or select a custom list.
• The separator is always a dash.
• Passphrases are generated per enrollment or per exported row; you cannot supply your own.

If the format is a problem for your deployment, email cpwordlist@neuralconfig.com — the service is actively developed.

Next steps

• How enrollment and fallback work — where a passphrase gets generated and how it reaches the user.
• Bulk DPSK export — generate the same passphrases in bulk for a property import.
• Security controls — how passphrase data is stored and for how long.