3 ms·

I'm not sure how safe this is against dictionary attacks. And it's still not overly easy to remember.

• ndriscoll 3y ago
  It's 100% safe from dictionary attacks. You can even make it grammatically correct. Just choose something like adjective-noun-adverb-transitive_verb-adjective-noun. If you choose each of six words randomly from a list of the 2k most common words with that part of speech, you get 66 bits of entropy, which is slightly more entropy than a random 11 character alphanumeric password with upper and lower case, but vastly easier to remember, type, and say out loud if you need to tell someone. Think of the words as just a view/rendering of a random bit string. You generate random numbers and then use that to index into your word lists to display those numbers. If you use an injective function for your view, you can choose it to have whatever "nice" (for humans) properties you want (e.g. grammatical validity), and no entropy will be lost (or gained).