 <blockquote> <p>Any suggestions which api or util to use for that purpose in JAVA?</p> </blockquote> <p>Main suggestion ... don't do it. It should be up to the end user to think up a passphrase. Any systematic scheme you implement for generating passphrases will be vulnerable to someone attacking your system.</p> <p>I am not aware of an API or utility that does this. But if you did find such an API or utility, you should immediately be suspicious of it:</p> <ul> <li><p>any "common" scheme for generating passphrases will attract attention from people trying to defeat it</p></li> <li><p>you should be concerned that someone has incorporated a backdoor in the scheme.</p></li> </ul> <p>The second problem is that a generated passphrase consisting of random English words won't be memorable, and hence the user is likely to write it down. Once they have done that, your security is defeasible by looking for bits of paper in their stolen wallet, etcetera.</p> <hr> <blockquote> <p>Well, I am also generating a random url and with each url a pin will be associated. URL is sent thru mail but PIN will be texted on their cells. So it wont be an easy hacking attack since my URL is also random. </p> </blockquote> <p>If someone can access the user's browser history, or snoop his network traffic, then they can find out what the random URL is.</p> <hr> <blockquote> <p>Or random number as PIN is fine?</p> </blockquote> <p>A randomly generated PIN is probably better than a non-random one (or one supplied by the user!) but neither is up to scratch ... unless they have 10+ digits.</p>