New comment on reddit

that way theres not really any pattern to it , but its mostly so i can easily remember it

No – you are not as clever as you think you are. People are very bad at creating "random" things – and generally break down into patterns: precisely what you described you do.

The most important thing about passwords is entropy. There are ~6 bits of entropy per character in the list of upper and lower case letters plus numbers (62 possible choices per position).

No – 8-11 characters are not enough

With 11 truly random characters, you have a maximum of just under 66 bits of entropy. 2^62 is not a big number of passwords to check – especially since, on average, you only need to check half of them (2^61).

NIST says real-world entropy of human-generated passwords is much much much lower:

• 4 bits – first character
• 2 bits – each of next 7 characters
• 5 bits – characters 9-20
• 1 bit – each character over 20

That means your 11 character, human-generated password has more like 4+(2*7)+(5*2)=26 bits of entropy. 2^26 is 67,108,864. Even at just 1000 guess per second, you only need 67,000 seconds, or about 18.5 hours to guess your password – and that's if you have to guess them all. On average, you'll only need to check half – reducing guess time to ~9.5 hours. And starting with sources like Have I Been Pwned, a probable wordlist, the known prevalence of leet-speak substitutions, etc, that guess time is likely reduced to minutes.

Add to this the fact that you're probably not even hitting the NIST estimates of human-generated password entropy … and you're up Schitts Creek with nary a paddle in sight (other than the one crackers are about to turn on you).

Use a password manager

Use a password generator

I built one you can grab off GitHub to run locally if you like.

Start with the ones in your browser – they're far better than nothing.