The math checks out
Except if it doesn't
If you are coming up with your own "random" passphrases, you are going to be cracked more-or-less instantly
Because you are not good at doing random things
But if you select those words truly (or close enough to truly that it doesn't really matter how untrue it is) randomly from a decently-large word list, then you don't know if the 3 words are "aibe" or "schoolteacherflibbertigibbetabsquatulating"
In fact, the whole point of using hash functions on passwords, and then storing those instead of the real password, is that the length every every password is "identical" – they're all 512 bits long (or however long the hash generates)
Add to this the salting that [sane] systems do, and my "aibe" is different from your "aibe"
September 23, 2019 at 03:46PM
via reddit https://www.reddit.com/r/security/comments/d8bd27/passwords_using_3_random_words_is_a_really_bad/f195ahf?utm_source=ifttt