I believe it comes from a good place, but this post is bad. Why? Because it doesn't apply the same comparison standard to character-based passwords than to wo

I believe it comes from a good place, but this post is bad. Why? Because it doesn't apply the same comparison standard to character-based passwords than to word-based passwords. Sure, we only use a few common dictionary words. But by the same token, our character-based passwords aren't random strings either: they are variation based on random words. This is the basis of the xkcd advice to use 4 random words: https://xkcd.com/936/ https://xkcd.com/936/ Notice Randall gives each word 11 bits of entropy, meaning he considers each word is chosen at random amongst a pool of ~2000 words. Yet that base is still much bigger than ~64 for characters. If you take 3 common words, you get ~8 billion possibilities. 4 common words: 17,000 billion. That's much more than than ~400 billion for a perfectly random (again: that's not the case in practice) password of 12 characters. And four words is easy to remember, 12 random characters is HARD. If anything bad can be said about the xkcd comic, it's that it doesn't hammer the point that it has to be FOUR words. As three is much less secure (but still probably more secure than the 12 characters password people are likely to use in practice).