> Having said this, I want to put a word in for a design change I think all of these tools should consider: don't accept user-provided passphrases by default. Instead, generate passphrases for the user, with a wordlist and entropy target.

I like this idea, but proper passphrase generation is hard:

1. My personal estimation is there maybe 2^(11-12) words that nearly-all English speakers know and spell the same way; note that this is much smaller than the vocabularies of the lowest percentile, but two people with 5k word vocabularies will have an intersection smaller than 5k words, and there are words spelled differently in different dialects. Also rarely used words are harder to recall.

2. At least for me, I confuse similarly sounding words on recall

3. There are lots of non-English speakers

4. You probably don't want your passphrase generator spitting out double-entendres

For my own personal use, I took the 2k most common words in the English language, used metaphone to remove words that were likely to sound the same, and I don't care about #3 and #4. This left me with over 512 but less than 1024 words remaining. 9 bits of entropy per key, a 5 word passphrase is memorable for most people giving you 45 bits of entropy total. I'm not a cryptographer, but I suspect 45 bits is "good enough" with something non-fancy like PBKDF2-HMAC-SHA1 and an improvement over a prompt, but I haven't solved all of the problems on the list. I think #4 can be safely ignored for a free product, but that concern specifically caused us to swap out passphrases for an alphanumeric password for a tool used at work.