Because a hash doesn’t work like a password cracker in a movie. It can try horse, but unless it gets the whole thing correct it doesn’t know any individual part of it.

Dictionary attacks have been around for a long time, but It's still quite strong especially if you throw in a number.

A fully random 8 character password has about 10^14 brute force combinations (assuming upper and lower case + the normal special characters). 4 words choosen at random from the top 3000 words (which is a very small vocabulary really) is 10^13 dictionary attack combinations, add a single number or account for variations in word style (I.e maybe don't always use camel case) and you've matched the difficulty. If you use 5 words it's 10^17 combinations.

(This is basicly copy pasted from a comment I made earlier)

If your services are storing passwords properly with a salt, dictionary attacks (including rainbow tables) are just as time-consuming to perform, since the salt renders each password hash unique; even for the same passwords.

So the same principle still stands; the longer your password, the longer to guess - as long as the encryption-at-rest is done correctly.

In the linked comic, Munroe assumes an attacker knows your method. The attacker isn't brute forcing character-by-character, but word-by-word, with an attacker who already knows you're using 4 random words.

i also dont really get it. the bitwarden pw tester says it will take 14 years to crack "its.a.beautiful.day", write beautiful with 2 t`s and it will take "centuries"? 🧐

but yes i still use them. but always with numbers and random characters in between and words from multiple languages or fantasy words.