I agree with your general point, but I have just a couple of mathematical points:

> For a normal 5 letter (alpha-numeric only) password: > 36

With the "normal" recommendation of numbers, uppercase and lowercase letters, and punctuation, it's up around 100.

> factorial

The calculation is X^Y, where X is the number of possibilities per element, and Y is the number of elements (letters or words in these examples). So using only only lowercase letters (26) in an 8 character password would be 26^8. It's not factorial because you can reuse characters (e.g., your password could be X92m-sXp/)

> the amount of possible words is much smaller than that. But the attacker can't know that for sure

They will search the more likely words first. I read someplace that 10,000 words covers most people's vocabulary. That's still 100 times better than numbers + uppercase + lowercase + punctuation.

>"The calculation is X^Y, where X is the number of possibilities per element, and Y is the number of elements (letters or words in these examples). So using only only lowercase letters (26) in an 8 character password would be 26^8. It's not factorial because you can reuse characters (e.g., your password could be X92m-sXp/)"

You're absolutely right, not sure why I got ahead of myself with using factorial so incorrectly.

You were probably thinking about the fact that picking, in order, 5 elements taken from a set of 1000 elements yields (1000 factorial) / (995 factorial) possible combinations.

I guess you meant 36 to the power of 5, instead of factorial. 36! is a much bigger number than 60 million; same goes for 1,025,109 a few lines below

You're making the incorrect assumption that all letters are equally likely, and all English words are equally likely.

I'd guess the words used in that password fall into the top 10k words, easily. No need to check words like pediatrician, when the password contains the word cat.

Technically true perhaps, but from my experience the word selection is always way narrower than that, like usually from maybe the 2000-5000 most common words.

Still a big number, but not astronomically big.

It's big enough to matter. 2000^5 ~= 60^9 so it's as strong as a 9 random character password which is usually regarded as strong enough, and far better than a typical 1 word with 3 or 4 special characters mixed in.

Too late to edit my post. I made a bit of a mistake referring to it as factorial.