Since commit 33baf46, the short1 wordlist is the default.

It would be nice to have the option to check generated passphrases against the list of leaked passwords from sources like Pwned Passwords which contains list of more than half a billion passwords which have previously been exposed in data breaches.

Pwned Passwords also implements a k-Anonymity model that allows a password to be searched for by partial hash.

If the user opts for checking the passphrases against the Pwned Passwords and it is found in the list then a new password should be generated for the user. This issue is inspired by the a Computerphile video.

See list of issues in https://github.com/grempe/diceware/issues
And also https://github.com/grempe/diceware/tree/master/lists

How is it better than diceware?

http://world.std.com/~reinhold/diceware.html
https://diceware.dmuth.org/

I got an error trying to use passphraseme that was due to my system being Debian Jessie, which is Python 3.4, and so it lacks the 'secrets' module.

miguel@syrah:~$ passphraseme 
Traceback (most recent call last):
  File "/usr/local/bin/passphraseme", line 7, in <module>
    from passphraseme import main
  File "/usr/local/lib/python3.4/dist-packages/passphraseme/__init__.py", line 6, in <module>
    from secrets import choice
ImportError: No module named 'secrets'

Is there a way to prevent the installation on a < 3.6 system via pip to avoid the false expectation? Maybe a hard dependency is needed somewhere? Otherwise an addition to the README.md is maybe good enough.

Passphraseme allows users to not use a word separator with --sep ""; for example passphraseme -sw --sep="" might give: "givenopportunityionreportedrimslukeshowed".

Passphraseme also allows users to use the EFF fandom lists, which are not uniquely decodable. For example, "light", "saber" and "lightsaber" are all on the Star Wars list. This can be an issue if a user runs passphraseme -sw --sep="" 5, expecting a 5-word passphrase and all the entropy that entails (about 60 bits), but instead gets "helplessyachtdecemberlightsaber", which is effectively a 4-word passphrase, giving only about 48 bits of entropy (again, this is because "lightsaber" is a single word on the list).

The EFF long and short lists avoid this issue because they do not have prefix words: "We also ensured that no word is an exact prefix of any other word." If we removed all prefix words from the fandom lists, we'd remove "light", since it's a prefix word of "lightsaber", and would avoid the issue described above.

Is this a serious, real-world issue?

Honestly, I've never been confident about a mathematical procedure to, given a not uniquely decodable list, calculate the actual chance of one of these issues actually happening. The issue also assumes that the attacker knows the word list that you used to create your passphrase and is brute-forcing through all possible 1-word passphrases, 2-word passphrases, 3-word passphrases, 4-word passphrases (where they would guess "helplessyachtdecemberlightsaber"!), etc..

But I've always thought there was good reason for EFF to remove prefix words on the long and short non-fandom lists. (And for 1Password's passphrase generator to require word separators.) tbh I'm kind of disappointed EFF didn't do the same for the fandom lists.

Possible solutions for Passphraseme

1. Force users to use a separator of some kind (in other words, do not accept a separator of ""), as 1Password's passhrase generator does.
2. Capitalize the first letter of each word if --sep is set to "". These capitalized letters effectively act as word separators ("LightSaber" vs. "Lightsaber").
3. Make all word lists uniquely decodable, either by removing all prefix words or another method (I have a preferred method). This solution has the disadvantage of making combining word lists, as requested in #18, complicated, as combining 2 or more uniquely decodable word lists will very likely result in a list that is NOT uniquely decodable.

As a suggestion, a simple function to retrieve a custom (.txt) wordlist could be useful.
Working implementation:
Argument:

parser.add_argument('-d', '--dictionary', nargs='?', metavar='dictionary', help='Dictionary file')

Reading:

if args.dictionary is not None:
        with open(args.dictionary) as f:
            words = [line.rstrip('\n') for line in open(args.dictionary)]

Example:

I would like an option to use multiple wordlists to generate a passphrase, say -sw and -st, or -hp and -got. For example: passphraseme -l -st -hp 8 or passphraseme -l & -st & -hp 8

P.S: Why is the --short1 wordlist default while the --large is more recommended elsewhere?