This question is inspired by this one:
[How long should 2 factor authentication codes be?](https://security.stackexchange.com/questions/167938/how-long-should-2-factor-authentication-codes-be)

Basically, there is a practical lower and upper bound of 2FA code length. It can't be too short such that an attacker with all passwords could bruteforce a significant percent of accounts. But it also can't be too long such that it's difficult to commit to short-term memory.

So then why not use a dictionary/diceware phrase? Something like `puppy banana galapagos moose` is just as easy to remember as `327229`, but offers much more entropy.

The only disadvantage might be that it is more time-consuming to type, but with mobile keyboards with autocomplete, it would only take an extra second or two while drastically decreasing the percent of accounts that could be bruteforced.