Family safe word
A phrase agreed in person that anyone claiming an emergency has to be able to say. A cloned voice can copy a person. It cannot know something that was never written down.
—
This tool needs JavaScript and a browser with the Web Crypto API. Without it, pick four ordinary unrelated words yourself — that is genuinely almost as good, provided you do not pick anything connected to your family.
There is deliberately no copy button. The moment this phrase is on a clipboard it is on its way into a message, a note, or a screenshot — which is the one thing that makes it useless. Read it aloud to each other in the same room, then close this tab.
How to use it
Agree it in person
Everyone who might be called — and everyone who might be impersonated — learns it in the same room. Children included, if they are old enough to answer a phone.
Keep it out of every device
Never send it by message or email. Never store it in a notes app, a photo, a contact card or a shared password vault. Anything on a phone can be read by whoever reaches that phone, and a compromised account is one of the routes by which these attacks start.
Use it when the call is urgent, not when it feels odd
The trigger is the request, not your instinct. Any call asking for money, for account access, or for secrecy gets the challenge — including calls that sound completely normal.
Treat failure as an answer
If the caller cannot produce the phrase, that is the end of the call. Hang up and ring the person back on the number you already have. Distress, anger and “there is no time” are the expected responses; they are also exactly what the script predicts.
What makes a good one
- Random, not meaningful. A pet’s name, a street you lived on, a wedding date — all of it can be researched or guessed. Unrelated concrete words are easier to keep secret because they connect to nothing.
- Concrete and picturable. Words you can see in your head survive stress far better than abstract ones. That is why the list behind this generator is ordinary objects and plain adjectives.
- Said aloud easily. It has to work down a bad phone line, spoken by someone frightened. Avoid anything with ambiguous spelling or an awkward mouthful.
- Long enough to be unguessable, short enough to recall. Four words is the usual balance. Five or six if the phrase covers a group that includes people outside the immediate household.
- One phrase, one group. If you want a separate arrangement with an elderly parent or a business partner, generate a separate phrase rather than reusing this one.
Why this works when listening does not
Detection of synthetic speech by ear has largely stopped being reliable, and it will not become more reliable over time. A shared secret has the opposite property: improvements in voice synthesis do nothing to it at all. The clone can sound perfect and still not know four random words. More on why the procedural check beats the perceptual one.
For a workplace the equivalent is written policy rather than a passphrase, so that no employee has to personally doubt a senior voice. There is a template for that. To put the callback rule somewhere it will be seen, print a card.
Questions people ask
Can we just text it to each other?
No. That puts it in at least two devices and one provider’s servers. Agree it face to face and keep it there.
What if someone forgets it?
Then the callback rule takes over: hang up and dial the number you already have. The phrase is a shortcut, not the whole defence.
Is this phrase stored or sent anywhere?
No. It is generated in your browser, held only in the page, and gone when you close the tab. There is no request to any server and no browser storage.
Can I use it as a password too?
Don’t. A password ends up in a manager, a breach corpus, or a browser autofill. This phrase’s value depends entirely on it existing nowhere but in people’s heads.
Reviewed