I’m a fan of xkcd, and one of its most quoted strips is the password panel (#936): Tr0ub4dor&3 versus correct horse battery staple. It changed how millions of people think about passwords. The message seems clear: forget the “complex” password, use four common words, and win on both security and memory. The detail almost nobody reads is the adjective: random. Four words you pick are not four random words.

The frame I care about: why inherited complexity rules fail, why the comic only works under specific assumptions, and what that means when language biases the initial letters of the words you memorize.

The comic is right… with dice

The bottom panel of xkcd assigns 11 bits per word to correct horse battery staple. That assumes uniform selection from a dictionary of about 2,048 common words ($2^{11}$). Four independent random words add up to ~44 bits, about 550 years at 1,000 guesses per second in the comic’s scenario.

That model is Diceware: roll dice, look up a list, repeat. Implementations like diceware.dmuth.org bring it to the browser with crypto.getRandomValues() (the passphrase is generated locally and never leaves your machine). The passphrase is memorable after being generated at random, not because you invented it.

If you truly pick four words at random from a large list, the comic is correct. The problem is almost nobody does that.

The comic fails… without dice

When you choose the words to remember them, you no longer have 11 bits per word. You have something much worse:

The simplified formula $H = L \cdot \log_{2}(N)$ only holds when each symbol has uniform probability $1/N$. If you choose the words, the effective $N$ per position is much smaller, and not the same for every letter.

Imagine deriving a password from the initials of twenty words you memorized:

• With a uniform 26-letter alphabet: $20 \cdot \log_{2}(26) \approx 94$ nominal bits.
• If your words mostly start with c, h, p, s, t, real entropy per position is closer to $\log_{2}(5\text{–}8)$ than $\log_{2}(26)$.

An attacker with an enriched dictionary does not try all combinations with equal priority. They try what humans choose first.

Entropy in five minutes

Shannon entropy measures uncertainty in a choice:

If each symbol is equally likely among $N$ options, this simplifies to $H = \log_{2}(N)$. For a sequence of length $L$ with independent symbols:

Length beats a “rich” alphabet when randomness is real. But without randomness, neither length nor alphabet saves you.

Two sides of the same mistake

In all three cases nominal entropy looks reasonable. Effective entropy is low because generation is human, predictable, and exploitable with substitution rules.

Where the rules came from

Policies requiring “at least one uppercase, one number, and one symbol” trace to NIST SP 800-63 (2003), associated with Bill Burr. The intent was to enlarge the search space. In practice, it trained people to produce recognizable patterns.

In 2017, Burr publicly acknowledged those guidelines had worsened effective security. The updated SP 800-63B recommends length, breached-password lists, password managers, and 2FA, not mandatory periodic rotation or ritual complexity.

xkcd’s closing line makes the same diagnosis from another angle: twenty years teaching passwords that are hard for humans to remember and easy for computers to guess.

The cost of typing complexity

Beyond entropy, there is usability. On a QWERTY keyboard, Shift and symbol keys increase typos, retries, and the temptation to reuse the same “hard” password everywhere.

Each uppercase letter is an extra keystroke. On mobile it is worse: you switch layers or long-press to move between cases, and a password that mixes both becomes slow and awkward to type with your thumb. If you enter that key often (laptop boot, vault unlock) you pay that cost every day.

Oral transmission matters too. Dictating Tr0ub4dor&3 forces you to clarify “that’s uppercase”, “zero, not letter O”, “at sign, not a”. An all-lowercase string reads straight through: “jay, en, ar, a…” without ambiguity. Useful when someone you trust helps recover a backup or when you rehearse the password out loud while memorizing it.

A long random lowercase string (generated by a manager) is faster to type, less error-prone, and clearer to dictate than a short password with complexity rules.

Modern cracking and AI-assisted attacks

Current attacks do not only try password and 123456. They use substitution rules (a→@, e→3, s→$), enriched dictionaries with proper names, and models that learn human patterns (PassGAN and similar).

“Disguised” passwords and “creative” phrases are the first candidates, not the last. AI does not break cryptography; it exploits that humans are not randomness sources.

Required caveats

• Real Diceware and truly random passphrases work. The problem is not words; it is non-random choice.
• Entropy is not everything. Credential stuffing, phishing, leaks, and reuse can compromise a strong password without guessing it.
• Site limits. Some cap length or reject certain symbols, another argument for long simple letter sequences.

What to do in practice

1. Password manager for almost everything. One strong master password; the manager generates the rest.
2. CSPRNG generation: never improvise.
3. Adequate length: ~18–20 random characters give ~75–94 bits with lowercase; enough for most contexts.
4. 2FA where it matters, TOTP, hardware keys, WebAuthn.
5. Diceware if you want words and have dice (or a reliable generator like diceware.dmuth.org).

In the RPS framework, this is conscious stone for day-to-day use: little ritual, maximum reversibility toward a manager, bounded cost of failure if the master password is strong.

Closing: random first

Complexity rules and the xkcd comic point in opposite directions, but they share an invisible requirement: randomness must be real. Without it, the comic’s math lies and NIST’s rules make things worse.

The practical question that remains: if you need to memorize a few critical passwords (the manager’s master key, laptop boot) without choosing the words or letters yourself, how do you do it without falling into the bias we just described?

In the next post I introduce tale (Tales Vault System): entropy first, story second.