Another example is "195884873718293401958657". Until that last 7 is added, it suggests avoiding dates (1958), repeating sections (1958), and having very common passwords (718293) is part of your password, but when that last 7 is added the suggestions go away.
I’d guess it stops making suggestions when it reaches a certain estimated strength. The suggestions are ways to reach that strength efficiently.
That’s nowhere near enough entropy for a proper password.
Just use the damn password manager already.
What do you base that on?
If you assume the password is stored using current best practices (ie, you use a key definition function like PBKDF2 or even better scrypt), it's tons. You can't assume a website will be using anything reasonable - but anything I manually enter this 12 character password into, like a password manager a modern auth service, or ssh it is reasonable.
Proof: assume you use a KDF that makes a check of a single password take at least 1ms on modern reasonable machine, 72 bits means it will take 149,642,763,799 (= 2^72 / 3600.0 / 1000.0 / 24 / 365.35) years to break. Sure you can parallelise it, so lets throw a billion of these "reasonable machines" at it. That reduces it to 149 years. I'll be well and truly six foot under before they crack it, which meets my definition of tons.
But it's better to look at it from the point of view of the worth of the information they get versus expense. Let's say for argument's sake my entire net worth is $100M. Lets also also say a "reasonable machine" worth $10. And finally assume the value of that $100M shrinks over time, so after 20 years it's worth almost nothing. Continue assuming we use a KDF to ensure doing one guess takes 1 second, and you end up with needing 62 bits of entropy - or 11 characters.
I'll stick with generated pseudo-random gibberish and a password manager.
I wrote a program to do this for me which I myself use, and anyone else is free to download and use it (open source, ISC license) :D
It supports a few different options, including one that will tell you what the passphrase entropy would be.
This is a case where I choose to believe xkcd unless and until you can provide convincing evidence otherwise.
This might seem reasonable, however, this is only a false economy as people tend to gravitate towards common words that evoke simple concepts, which drastically reduces the search space.
A dictionary attack isn't anything novel and the proliferation of this technique would only make life easier for the baddies.
You could argue that passphrases aren't even competing with randomly generated passwords but rather with the naive passwords that people come up with that has simple character substitution for special characters.
However, this is the same reason why it should only be confined to use in places where a yubikey for active directory windows login or a password manager wouldn't be practical.
If you're going to use a tool to generate your passphrase, why not use a tool to store it and retrieve it at will, while also protecting yourself from shoulder surfing?
> Your password is pretty good. Use it only for this account. (Why?)
> To make it even better:
> Don't use dictionary words (Correct, Battery, Staple and Horse) (Why?)
> Consider using 1 or more symbols (Why?)
> Consider using 1 or more digits
This essentially goes against the advice that passwords should be complex but also easier to remember (yes, many people still don’t use password managers) and also the advice not to force users to add symbols or digits.
I tried a few other different passwords and pass phrases with digits and symbols, but I saw a subtle coercion in the suggestions that would make a lay user doubt the password-strength meter and create extremely long and complex passwords (no pass phrases, since dictionary words and even terms in Wikipedia are flagged). It encourages you to add more digits and symbols even when you’ve already used a few.
In short, the password-strength meter seems fine, but the suggestions are not great.