I read about Diceware passphrases and whipped up a little program to generate passwords in that style. I do this by taking the list of dictionary words to create passwords and "ordering them" by a random number (one produced by System.Security.Cryptography.RNGCryptoServiceProvider), in essence shuffling them. I then pass that into a queue and dequeue words when a password is to be generated.

This is a little bit different from the pen-and-paper version, since there is a chance there, however remote, that a word may be repeated. So clearly we reduce the number of possible passwords somewhat. Does this reduction in possible passwords significantly change the susceptibility of such passwords to cracking? Would it be better to read the dictionary into an array and get words by generating a random number and accessing the array at that index?