That’s exactly what I worked out a long time ago when looking at password managers and policy for my company. We had 8char, special, number, rolling 90 days, e

That’s exactly what I worked out a long time ago when looking at password managers and policy for my company. We had 8char, special, number, rolling 90 days, etc. Awful. I had looked at 3 random words as advice and same conclusion, even at 10,000 most common words, it was beyond trivial for offline cracking. 10,000 most common words ^ 3 and 100,000,000 guesses / sec is a few hours to crack. That’s the same complexity as 6x random keyboard characters. Not even sort of good. Our last pen test was rife with offline cracking. I ended by teaching passphrases and recommending at least 4 words or whatever tricks they like and will remember. In four years since, not a single forgotten password request.