With all due respect: "Profiting-Spooky-Percolation-Throatier-Overtures-Gentiles-Boffin-Mockery-Essentialist-Discouragements99" isn't very memorable. Granted, I cranked that one up, but the default settings generated "Ennobled-Healthiest-Narrowing-Decongestants29"; not something I will remember either. We shouldn't encourage "memorable" passwords in the first place, we should encourage passwordmanagers and unique passwords per site. "Memorable passwords" are only memorable as long as you have maybe a few; which will result in password reuse which is bad. I don't know any of my passwords other than my machine logon and passwordmanager master password. And that's how it should be. And if you're using a passwordmanager anyway, then why make 'memorable' or even 'human friendly' passwords in the first place? You can just as easily generate passwords like "j@jS8Ruj45ow1H&S4Z*4%d6AG" and store those in your passwordmanager. Most (if not all) of my 200+ passwords in my passwordmanager are 25+ random characters with a few exceptions of some retard sites that limit passwords to 12 chars or so. My machine logon is 10 random chars and my master password is 18 random chars. Those are the only two I memorized (and won't forget easily because I use them regularly as opposed to sites where my last logon may have been 6 years ago). Having said that: I'm sure it was a fun project and you probably learned a thing or two creating it. It looks nice. More on reddit.com

How effective is a very large wordlist at cracking hashed passwords as compared to a rule-based or combinator attack?

Aren't users more likely to concatenate words or characters than to use a single word from Middle English?

More on reddit.com

Are random words more secure or just better because easier to remember? In short, passphrases (string of random words) are better to use for the vault master password, because they are more memorable. It makes no sense to claim that a string of random characters is stronger than a passphrase, or vice versa — you can adjust the entropy (log2 of the number of combinations) of either the character string or the passphrase by changing the length (number of characters or number of words) and/or the size of the pool of characters or words from which the random picks are being drawn. Thus, it makes most sense to compare the two approaches when configured to have the same entropy (equal "strength"). In this case, the random string approach will have the benefit of being shorter (typically 1/3 the length of the passphrase), but the passphrase will have the benefit of being more memorable, which is why it is preferred for the master password (which is the only password that should be memorized). Passphrases also have a use in situations that do not require memorization, but that require the credential to be transcribed by manual typing, or spoken verbally. For all other situations, a passwords consisting of a random string of characters is probably better, due to the shorter length (i.e., less likely to violate maximum length restrictions that many websites foolishly impose). For a master password to use with Bitwarden, a passphrase consisting of 6-7 words will get you in impenetrable vault. A slightly shorter passphrase (4-5 words) may also be adequate, especially if the dollar value of assets in your vault is not in the 6 figures (see here for an analysis). This assumes that you have used a random passphrase generator to create the passphrase. More on reddit.com

Readable Passphrase Generator. I don't use it intensively, but I have installed it, and it seems very convenient. https://github.com/ligos/readablepassphrasegenerator One remarkable thing about it is it's also available as a website. Its the same algorithm : https://makemeapassword.ligos.net That site is very useful as an educational resource, in order to tinker with passphrases and understand how they work. However, it generates the passphrases on its server, not on your computer. So although I don't have any reason to doubt the developer's honesty, one might prefer to use that other site, which also uses the same code basis, but generates the passphrases locally : https://saintly.zeck.net/readablepassphrase More on reddit.com