The total possible permutations of characters in just an alphanumeric 12 digit random password is 36¹², which is around 400 times larger than the number of perm

The total possible permutations of characters in just an alphanumeric 12 digit random password is 36¹², which is around 400 times larger than the number of permutations possible with 4 words picked out of a pool of 10,000 or 10000⁴. This might seem reasonable, however, this is only a false economy as people tend to gravitate towards common words that evoke simple concepts, which drastically reduces the search space. A dictionary attack isn't anything novel and the proliferation of this technique would only make life easier for the baddies. You could argue that passphrases aren't even competing with randomly generated passwords but rather with the naive passwords that people come up with that has simple character substitution for special characters. However, this is the same reason why it should only be confined to use in places where a yubikey for active directory windows login or a password manager wouldn't be practical. If you're going to use a tool to generate your passphrase, why not use a tool to store it and retrieve it at will, while also protecting yourself from shoulder surfing?