Fully random: 62^18 in that format, or about 107 bits of entropy. Their approach: ~71 bits per the article (I counted ~73 bits but I’m not using their exact al

Fully random: 62^18 in that format, or about 107 bits of entropy. Their approach: ~71 bits per the article (I counted ~73 bits but I’m not using their exact algorithm) I’d say it’s not too bad. With a good password hashing algorithm you’re looking at nearly 2^100 operations to bruteforce their passwords, which isn’t going to be feasible anytime soon. (Even with a crappy hash algorithm it’s still going to be over 2^80 operations). And, in this case, that entropy trade off means the passwords are easier to remember and type in, making it more likely for humans to actually use those passwords.