This is mostly good, but you should use four to seven random words, not three.<p><a href="http://canonical.org/~kragen/sw/netbook-misc-devel/bitwords.py" rel="nofollow">http://canonical.org/~kragen/sw/netbook-misc-devel/bitwords....</a> has several different ways of generating strings of random words from strong randomness, as well as other forms of random passwords. It uses the frequencies from the British National Corpus <a href="http://canonical.org/~kragen/sw/wordlist" rel="nofollow">http://canonical.org/~kragen/sw/wordlist</a>. The word lists I've found most effective have 2048 or 4096 words, thus 11-12 bits of entropy per word; much larger lists of words include a lot of strange words that are much harder to memorize. So, person acid hidden, cases truck merge, KNIT SOOT CEIL, worn profession products, claw gerry teeth, or TIDY ANY HUG, but not fitzwilliam preside maxine, relieve scottish seminar, or tunis orange formerly, which use a 32768-entry wordlist.<p>However, three 12-bit words is only 36 bits of entropy. If an unsalted password hash database containing 2000 users' passwords gets stolen, every 34 million hash operations will yield one of those passwords. If a <i>salted</i> password hash gets stolen, every 34 <i>billion</i> hash operations will yield one, but the attacker can choose which one.<p>To non-computer people this probably sounds like a lot, but john on one core of this quad-core laptop can try 8500 md5crypt passwords per second or 480 bcrypt passwords per second with 32 iterations. So one password cracked per 34 million hash operations, assuming md5crypt, is one user account cracked every 17 minutes, and one password cracked per 34 billion hash operations is an average of 12 days to crack your target password.<p>Unless the attacker has more than a US$300 used laptop to attack with, that is. If they're using a 19" rack full of equipment, possibly equpiment that doesn't actually belong to them, they could quite easily have 256 times as much hashpower, so they can crack your password in 65 minutes. Or 19 hours if you were using bcrypt or something better like scrypt, configured for that level of resistance.<p>By contrast, if you use <i>four</i> random 12-bit words, they'll need 130 <i>years</i> with my laptop to crack your account if it's using md5crypt, 6 months if they're using a rack full of equipment, or 9 years if they're using the rack full of equipment but the passwords were hashed with 32-round bcrypt.<p>With a 72-bit-entropy password like "thank reason massive derived reasonably go", "pick sat adams orcs arabs being", or "ALL JURY SAUL BILK ADD RULE CUB", you should be reasonably safe even with a poorly chosen password hashing algorithm and a more seriously funded attacker.<p>If the password hash database is not stolen, and the attacker is limited to an online attack, three words might be reasonable, but four words is safer.<p>A key point that people often miss here is that you <i>really need to use real randomness</i> to generate the passwords. Don't use "random" passwords from your mind, because, as any mentalist knows, those are enormously less random than you think they are. Use actual physical dice, as with Diceware, or /dev/urandom.