I have a slightly more complex scheme that eliminates some of the drawbacks of humanhash, while adding some of its own. Given a word-hash, and the number of bit

I have a slightly more complex scheme that eliminates some of the drawbacks of humanhash, while adding some of its own. Given a word-hash, and the number of bits per word that were used to generate it, it gives back the original numeric hash in the obvious way (by hashing each word and truncating the hash, then concatenating the bits); in the other direction, given a numeric hash, a wordlist to draw from, and a desired number of bits per word, it finds all the words in the dictionary that truncate to the appropriate hash bits, and offers the user a choice of them, then concatenates the chosen words. This has the nice property that a given set of words uniquely translates back to a specific hash, and that the user can use their favorite wordlist as long as it's large enough. If you were to use it for recognition rather than memorization (and wanted fewer words to remember) you would have to manually decide where to truncate the hash before converting it. If you wanted to pick a specific wordlist, you could do that. I originally came up with this as a system for helping to memorize IPv6 addresses; it also works as a system for passphrase generation (first generate a random number with the desired number of bits of entropy, then convert to words.)