In response to post #31586835. #31595470, #31596950, #31597315 are all replies on the same post. It really depends on if you follow an obvious pattern in your number/character addition. There are about 10,000 common English words (Closer to 30,000 total, but most conversations and books stay within the common 10k) so if you use four words, as in the comic, you get 10000^4 possible options. This means, on average, brute force would have to check half those. ~= 5x10^15 If you use an 8 character password that is NOT dictionary based, you have 26 lower case letters, 26 upper case letters, 10 numbers, and about 30 easily typed ASCII punctuation marks ( !@#$%^&*()-_=+[{]};:'",<.>/?\| ) giving us 92^8 possibilities, half of which (on average) an attacker would need to try, giving us ~ 2.6x10^15 (about half as strong as the four words.) However, many people use longer passwords than this. My shortest passwords for unimportant sites are 8 characters, and tossing a couple extra characters in is relatively easy. Let's say we used a 10 character password, and again divide by two for the average guess: ~2,17x10^19, or about 5000x stronger than those four words. Now, I realize that you could, theoretically, add more words, but most sites (sadly) limit maximum password length fairly aggressively, usually somewhere between 10 and 20 characters (this is a terrible practice, but sadly a reality) which makes more than a 4-5 word password very difficult. For most sites, expanding the characters provides better security than using a sentence.
