Xkcd was advocating diceware, not &quot;making up a passphrase&quot;. If your pool of words is sufficiently large, your rolls are random, and you have enough rolls, your password should be as secure as a random number.