Years ago I needed to generate default/initial passwords for CRM systems that weren't trivially crackable. I wrote a little script that picked 5 words from a 22

Years ago I needed to generate default/initial passwords for CRM systems that weren't trivially crackable. I wrote a little script that picked 5 words from a 22e3 dictionary. It's about 70 bit security assuming the adversary knows the dictionary. Not perfect but a whole heck of a lot better than installing stuff with "admin:admin" as is shockingly common. It still irks me how many places have 1. short password length limits and 2. stupid character class requirements. I use long as heck pass phrases everywhere I can't use a password manager but a shocking number of businesses are still like "max length 12 use 1 capital 1 number 1 symbol" :/