Missing is the analysis of the amount of entropy in an unaided "three random words" password. I'll try: people are lousy at random picking. Their choices are

Missing is the analysis of the amount of entropy in an unaided "three random words" password. I'll try: people are lousy at random picking. Their choices are highly likely to come from the most common 1000 words, and very very likely to come from the most common 4000 words. If this is true, it gets you an entropy of 30 to 36 bits. BUT Just for curiosity I checked out NIST's current guidance on passwords; they actually allow 6-digit passwords (PINs) [with about 20 bits of entropy], as long as there is server-side rate limiting of authentication attempts [edited to add:] and are uniformly chosen by the server. They recognize that this does not mitigate offline cracking attempts. Since even choosing a random "top 100" word would meet the same entropy bar, perhaps my initial reaction is an over-reaction. [https://pages.nist.gov/800-63-3/sp800-63b.html#appA https://pages.nist.gov/800-63-3/sp800-63b.html#appA]