&gt; But you’re forgetting the massive GPU array. The hacker runs a program that generates random combinations of two, three or four dictionary words and tries it against your password hash. It’s going to take a while because the number of such combinations are very large, but it’s not impossible.<p>The xkcd comic suggests a combination of four from a very modest 2000 (2^11) common words resulting in ca. 2^44 combinations to check. It also assumes 100 guesses&#x2F;sec which result in over 500 years to break. That&#x27;s precise math and a somewhat reasonable assumption.<p>You counter this with an argument like &quot;the number of such combinations are very large, but it’s not impossible&quot;. You give no new numbers, no counter-assumptions, you don&#x27;t argue that 100 guesses per second is too slow, you just state this.<p>So in this form your argument is ungrounded.