No, goddamnit! The search space of possible passwords is the metric that matters. This is why people should not be rolling their own password schemes. 27 possi

No, goddamnit! The search space of possible passwords is the metric that matters. This is why people should not be rolling their own password schemes. 27 possible chars * 16 length gives 27^16 combinations, or about 8.0 * 10^22 combinations. (Although much, much less in practice because you're using common english words separated by spaces.) Printable characters, including punctuation like { } | & etc, gives you 95 characters, for 4.4 * 10^31 combinations - about fifty million (50,000,000) times larger. Also, the main attack (which the article misses) happens offline, where the bad guys have compromised a system and downloaded all of the password hashes. In that case, they're only limited by the hardware that they can throw at it - FPGAs and high end graphics cards can check stupid numbers of hashes per second. http://nsa.unaligned.org/ http://nsa.unaligned.org/ is from 2007, and will check 800 passwords * 64 chars * 8 length in about a day.