A password grammar for speech recognition is described. A password is normalized into a list of strings of a plurality of character types such as letters and numerals. For each string of letters, one or more corresponding letter permutations are determined which represent pronounceable combinations of that string. Then, for each letter permutation, a corresponding recognition grammar entry is created for a speech recognition grammar.