diff --git a/hel/src/repl.rs b/hel/src/repl.rs
index 06047c9..73ca961 100644
--- a/hel/src/repl.rs
+++ b/hel/src/repl.rs
@@ -142,7 +142,9 @@ impl<'a> LKEval<'a> {
             Command::Noop => { to_history = false; },
             Command::Help => {
                 out.o(concat!(
-                    "hel - passwords are generated from your master + the entry name; nothing secret is stored.\n",
+                    "hel - S/KEY (RFC 2289) deterministic passwords from your master + the entry\n",
+                    "name; nothing secret is stored. The default mode is six short, memorable words\n",
+                    "(the \"correct horse battery staple\" idea from xkcd 936).\n",
                     "\n",
                     "entries\n",
                     "  add <name> [len][mode] [seq] [date] [text] [^parent]   define an entry\n",
@@ -162,7 +164,8 @@ impl<'a> LKEval<'a> {
                     "  save [target]     write it (file / localStorage key / |command)\n",
                     "  source <target>   load it                    set <key> <val>   config\n",
                     "\n",
-                    "modes  R regular  C camel  N nospace  H hex  B base64  D decimal   (U.. = UPPER)"
+                    "modes  R words  C camel  N hyphenated  H hex  B base64  D decimal   (U.. = UPPER)\n",
+                    "       R is the six-word S/KEY form: memorable, pronounceable, easy to type anywhere."
                 ).to_string());
             }
             Command::Mv(name, folder) => self.cmd_mv(&out, &name, &folder),
diff --git a/helwasm/index.html b/helwasm/index.html
index 0a48e59..70107a1 100644
--- a/helwasm/index.html
+++ b/helwasm/index.html
@@ -43,7 +43,10 @@
             <strong>re-generates</strong> each one on demand from your single
             <em>master password</em> plus the <em>name</em> of the account. The same name +
             master always produce the same password — so there is nothing secret to leak,
-            sync, or back up, and you only ever remember one phrase.
+            sync, or back up, and you only ever remember one phrase. By default each password
+            is six short, memorable words — the <em>correct horse battery staple</em> idea from
+            <a href="https://xkcd.com/936/" target="_blank" rel="noopener">xkcd 936</a> — built on
+            the classic S/KEY one-time-password scheme (RFC 2289).
           </p>
           <p class="about-privacy">
             <strong>Private by design.</strong> Everything happens on your device. Your master
@@ -73,9 +76,9 @@
             <div>
               <h4>Naming rules</h4>
               <p>
-                After a name you can add a length and a mode — <code>R</code> words,
-                <code>C</code> camel, <code>H</code> hex, <code>B</code> base64, <code>D</code>
-                digits (<code>U…</code> = upper). E.g. <code>github 20R</code>.
+                After a name you can add a length and a mode — <code>R</code> six memorable words
+                (the default), <code>C</code> camel, <code>H</code> hex, <code>B</code> base64,
+                <code>D</code> digits (<code>U…</code> = upper). E.g. <code>github 20R</code>.
               </p>
             </div>
           </div>
diff --git a/helwasm/pkg/helwasm_bg.wasm b/helwasm/pkg/helwasm_bg.wasm
index 281df3b..c137e41 100644
Binary files a/helwasm/pkg/helwasm_bg.wasm and b/helwasm/pkg/helwasm_bg.wasm differ