One little problem with your passphrase is, it's grammatically correct. If the attacker suspects as much, this will dramatically reduce the search space.
Personally, I'd rather bet on something like Diceware.
Personally, I'd rather bet on something like Diceware.
[0]http://www.lingholic.com/how-many-words-do-i-need-to-know-th...
Some words are way more common than others, and they are much more likely to be found in your passphrase if you didn't use an external random index generator (be it a set of dice or /dev/urandom), because of availability bias: you're more likely to chose common words, or even worse, uncommon words pertaining to your interests.
Diceware uses a smaller set (about 8K words), but if you select them truly randomly, you'll get close to 13 bits of entropy per word —guaranteed. I wouldn't cry too much over the loss of 2 bits per word, because Diceware words tend to be short.
Then again, even a word in a grammatically correct sentence is likely to have more than the 6-7 bits of entropy a character may have. I wouldn't bet on anything above 10, though.
I've heard the average entropy of English is 3 bits/character, in which case 14-15 bits sounds about right for a word.
91 characters, in 21 words. 4.3 characters on average, which would mean 13 bits of entropy. I don't believe it. It sounds like your source didn't account for word frequencies in real sentences, let alone grammatical constraints.
So just random words and half-words are appended, like: 'misfortune behold oratory plexum'
Then again, these things tend to just stick very well in my mind, so it may not be appropriate for everyone. Also, I only need to do this on certain services, so it's not that many to remember.
The hard part is when they then reply with "requires at least one upper case character, number, symbol, etc.". A certain XKCD comic comes to mind...
Lorem ipsum random garbage 1