Loading page
About this tool
Create a memorable, high-entropy family verification phrase locally for voice-clone, impersonation, and emergency-message scams.
The Family Safe-Word Generator builds a spoken verification phrase by drawing words at random from a fixed 92-word list of plain, easily heard English nouns and appending random digits — the default of five words plus three digits gives about 42.6 bits of entropy. Every character comes from the browser's crypto.getRandomValues with rejection sampling, so no word or digit is more likely than another, and the phrase is never stored or transmitted. It is for families who want an agreed answer to the question "prove it's really you" when a call, voice note or message claims there is an emergency.
Open Family Safe-Word Generator on AltFTool — it loads instantly in your browser.
Under Your private phrase, set Number of words and Final digits — the default five words plus three digits is about 42.6 bits from the 92-word pool.
Press Generate private phrase; changing the selectors afterwards does not replace what is shown until you press Generate another, so nothing is overwritten by accident.
Press Copy phrase and record it offline, checking the Estimated search space in bits printed beneath the phrase.
The 92-word pool is short, concrete nouns like harbor, thistle and quartz, so the phrase can be said and heard correctly over a poor connection or a crying voice.
Words and digits are drawn with crypto.getRandomValues plus rejection sampling, which removes the modulo bias that a naive random index would introduce.
Alongside the phrase you get the rules that make it work — ask for the whole phrase, give no hints, hang up and call back on a saved number, and replace the phrase after any real use.
The default five words plus three digits is roughly 42.6 bits of entropy, drawn from a 92-word pool. You can shorten to four words and two digits for about 32.7 bits or extend to six words and four digits for about 52.4 bits — for a phrase a caller must say aloud, guessing is not the realistic attack, so favour a length everyone can actually remember.
It is a shared phrase used to verify that an urgent caller or message really is your relative, which defeats scams built on cloned voices or hijacked accounts. The rule that makes it effective is simple: no money, no codes and no personal details move until the whole phrase has been said correctly.
Somewhere offline and out of any messaging app — written on paper at home, or in each person's password manager. Sending it in a family group chat or an email puts it in the exact account a scammer would compromise first.
Replace it after any real incident where it was spoken, after it has been shared over a channel you do not control, and whenever someone who knew it is no longer part of the trusted group. A phrase used once during a live scam attempt should be treated as burned.