Sorry for going slightly OT but I think more people should know this:

xkcd style passwords are actually called diceware passwords [1], the wikipedia article [2] links to arstechnica that reported in 2014 [3] that the original author upped his recommended diceware password length to at least 6 (random) words.

You can obviously always use a bigger dictionary too (as long as you choose truly random).

[1] http://world.std.com/~reinhold/diceware.html funny enough, chromium doesn't like the ssl versions the site uses "ERR_SSL_FALLBACK_BEYOND_MINIMUM_VERSION"

[2] https://en.wikipedia.org/wiki/Diceware

[3] http://arstechnica.com/information-technology/2014/03/dicewa...

Just to add to that. The program as it currently is rarely finds passwords that consist of more than 3 long words, which can still amount to decently long passwords. I have not tried to give it an english dictionary as a seed population. Maybe it would perform better if I do that.