The article mentions rainbow tables which imply unsalted-stored password hashes. I think that's a pretty rare development practice these days. That only partia

The article mentions rainbow tables which imply unsalted-stored password hashes. I think that's a pretty rare development practice these days. That only partially answers your question because the server-side algorithm for the key deriver function and its computing cost config parameters, in addition to the quality of the random data sources, the PRNG (e.g. fortuna), and the salt length, also play a role in the strength. See: https://owasp.deteact.com/cheat/cheatsheets/Password_Storage_Cheat_Sheet.html https://owasp.deteact.com/cheat/cheatsheets/Password_Storage... At any rate, I agree that a long and easy-to-remember phrase is fine, but that's impractical (due to being invalid for most logins) so you can also generate passwords like this (99 = pick your length): cat /dev/urandom | LC_CTYPE=C tr -cd [:graph:] | head -c 99