But a randomly generated 9 character password is still stronger. There is a big over-confidence in pass phrases. As pointed out by other comments there is a pre

But a randomly generated 9 character password is still stronger. There is a big over-confidence in pass phrases. As pointed out by other comments there is a predictible ordering to words in a passphrase. If you slip up like the parent commenter you end up with something that is actually weak. Pass phrases need rules (like requiring a non-dicitionary word).