this is easier to understand with a bit of math..<p>let&#x27;s say you have a pad lock with a 4 number combination, each of those numbers being a ring of 6 numbers themselves(o)<p>we have four &#x27;slots&#x27; with six possible numbers for each slot<p>that means there are a total of 1296 combinations, (possible values)^(slots), 6^4=1296<p>a contemporary computer can do 1300 calculations perceptually instantaneously<p>now we look at randall and diceware&#x27;s suggestion of using a series of words to bulk out your password, since a word in english is built of a possible combination of 26 character alphabet the possible values becomes 26<p>for a four letter word, all possible combinations of those 26 characters becomes 26^4=456,976 possible combinations, again, all values can be computed in nanoseconds<p>what i think randall and diceware is hoping to achieve is a higher permutation value with little tax on the user&#x27;s memory<p>conceptually [c,o,r,r,e,c,t,h,o,r,s,e,b,a,t,t,e,r,y,s,t,a,p,l,e] is 25 characters long with each &#x27;slot&#x27; having 26 possible combinations.. 26^25~23x10^34, that is a huge number of possible permutations which makes brute forcing finally impractical<p>but here is where the whole thing starts to break down a bit..<p>because the suggestion is to use real words to aide in remembering which negates character length in lieu of number of words<p>that also means that figure above is significantly less because the first in that list of 456,976 permutations is [&#x27;a&#x27;,&#x27;a&#x27;,&#x27;a&#x27;,&#x27;a&#x27;] which would be invalid in regard to existing words, so in reality that 450,000 figure is significantly less<p>&#x27;correcthorsebatterystaple&#x27; can be broken into 25 characters &#x27;slots&#x27; or 4 word &#x27;slots&#x27;: [correct,horse,battery,staple]<p>what was 26^25, is now (possible words)^4<p>we can keep going, look at randall&#x27;s most recent book(i), using the 1000 most used words<p>possible words becomes 1000 and 4 slots we are looking at 1000^4=1,000,000,000,000 possible permutations<p>which will take a contemporary laptop a few hours, respectively, to churn out<p>all this broken into a chart:<p><pre><code>     81 = 3**4 : [(3),(3),(3),(3)]
     253 = 3**5 : [(3),(3),(3),(3),(3)] 
     256 = 4**4 : [(4),(4),(4),(4)] 
     456976 = 26**4 : [(26),(26),(26),(26)]
     1000000000000 = 1000**4 [(1000),(1000),(1000),(1000)]
    ~230000000000000000000000000000000000+ = 26**25 : [(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26)]
    ~640000000000000000000000000000000000000000000+ = (26*2+10)**25 : [(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62)]
</code></pre>
what this is showing you, is that anything that makes things easier for you also will make things easier for a cracker<p>for best security increase the number of characters when possible avoiding words.. using a combination of lowercase(26 characters) and upper case(26 characters) and numbers(0-9, 10) for 26+26+10=62 possible values.. and put those characters in as many slots as you can muster<p>(o) <a href="http:&#x2F;&#x2F;www.padlocks4less.com&#x2F;media&#x2F;catalog&#x2F;product&#x2F;cache&#x2F;1&#x2F;image&#x2F;9df78eab33525d08d6e5fb8d27136e95&#x2F;c&#x2F;o&#x2F;combination_padlocks_2.jpg" rel="nofollow">http:&#x2F;&#x2F;www.padlocks4less.com&#x2F;media&#x2F;catalog&#x2F;product&#x2F;cache&#x2F;1&#x2F;i...</a><p>(i) <a href="https:&#x2F;&#x2F;xkcd.com&#x2F;thing-explainer&#x2F;" rel="nofollow">https:&#x2F;&#x2F;xkcd.com&#x2F;thing-explainer&#x2F;</a>