Return to Answer

"Not considering brute force" - that's exactly what these tools measure.
Obviously they dont try social engineering, or trying to discover if it's the user's first girlfriend's dog's birthday. The attacker might know that, but these tools don't.

What they do measure is simply the difficulty for a bruteforcing tool to crack it. Entropy, yes, but length can play an even more important part in making a password uncrackable.
so, in your case - yes, the 32-character, alpha-only passphrase is much stronger than the 8-character punctuation password.

I'm gonna try and do the maths here for a bit: (please correct me when I'm wrong):

If we assume standard US-style keyboard, there are 85 possible printable characters (possibly be able to scrape a few more, but lets go with this for now): lowercase letters + upper case letters + numerals + standard punctuation + space.
This grants ~6.3 bits strength per character; at 8 chars length the password gives you ~50.4 bits strength.
Note really very strong... Even if we throw in a few more "special" characters, you're not going to upgrade that very much.

Now, for your 32 character, alpha-only passphrase...
Let's assume lowercase and uppercase letters only (even though you didnt use any), plus a space (U+32). Not even numerals...
That gives you 54 possible characters, around ~5.8 bits per character. At 32 chars long, thats over 185 bits strength. Substantially stronger. And that's even without numerals, which are usually accepted even in "simple" password schemes.

Bruce Schneier often talks about how switching to long memorable passphrases would be much more secure than short, randomized weird-looking passwords.
Now you see why.

"Not considering brute force" - that's exactly what these tools measure.
Obviously they dont try social engineering, or trying to discover if it's the user's first girlfriend's dog's birthday. The attacker might know that, but these tools don't.

What they do measure is simply the difficulty for a bruteforcing tool to crack it. Not even the entropy of the password, which is an attribute of the generation method, just an estimate of how long it would take a bruteforcing tool to successfully find the correct password.
Obviously, entropy has an effect on this, but it is only total entropy that matters, not entropy-per-character. So yes, having a lot of equi-probable options for each character does add to the entropy, but length can play an even more important part in making a password uncrackable, by raising the entropy-per-character to a higher power, by character count. This makes for a much higher total entropy, which is the only thing that matters.

So, in your case - yes, the 32-character, alpha-only passphrase is much stronger than the 8-character punctuation password.

I'm gonna try and do the maths here for a bit: (please correct me when I'm wrong):

If we assume standard US-style keyboard, there are 85 possible printable characters (possibly be able to scrape a few more, but lets go with this for now): lowercase letters + upper case letters + numerals + standard punctuation + space.
This grants ~6.3 bits strength per character; at 8 chars length the password gives you ~50.4 bits strength.
Note really very strong... Even if we throw in a few more "special" characters, you're not going to upgrade that very much.

Now, for your 32 character, alpha-only passphrase...
Let's assume lowercase and uppercase letters only (even though you didnt use any), plus a space (U+32). Not even numerals...
That gives you 54 possible characters, around ~5.8 bits per character. At 32 chars long, thats over 185 bits strength. Substantially stronger. And that's even without numerals, which are usually accepted even in "simple" password schemes.

Bruce Schneier often talks about how switching to long memorable passphrases would be much more secure than short, randomized weird-looking passwords.
Now you see why.

"Not considering brute force" - that's exactly what these tools measure.
Obviously they dont try social engineering, or trying to discover if it's the user's first girlfriend's dog's birthday. The attacker might know that, but these tools don't.

What they do measure is simply the difficulty for a bruteforcing tool to crack it. Entropy, yes, but length can play an even more important part in making a password uncrackable.
so, in your case - yes, the 32-character, alpha-only passphrase is probably stronger than the 8-character punctuation password. But seeing why that is true is more interesting than just knowing which is stronger in this case...

I'm gonna try and do the maths here for a bit: (please correct me when I'm wrong):

If we assume standard US-style keyboard, there are 85 possible printable characters (possibly be able to scrape a few more, but lets go with this for now): lowercase letters + upper case letters + numerals + standard punctuation + space.
This grants ~6.3 bits strength per character; at 8 chars length the password gives you ~50.4 bits strength.
Note really very strong... Even if we throw in a few more "special" characters, you're not going to upgrade that very much.

Now, for your 32 character, alpha-only passphrase...
If we consider it to be a random sequence of lower case chars and spaces (27 possible characters, ~4.7 bits per character. At 32 chars long, that's over 150 bits strength. (If you selected randomly from uppercase chars too it would be over 180 bits strength.)

Substantially stronger. And that's even without numerals, which are usually accepted even in "simple" password schemes.

BUT

That punctuation-filled password isn't really a random series of 8 characters from the 85 printables. Its an l33t-sp34k version of "this val" with the standard substitutions i->1, s->$, space->., a->4. And "this val" is just a pair of common words. The entropy of this password is probably ~25 bits for the choice of the two words, and perhaps 5-10 bits for the choice of substitutions, for an overall complexity of ~35 bits.

And the passphrase isn't a random sequence of lower case chars and spaces, either. There are many more spaces than you'd expect, for a start. And lots more vowels. In fact, English sentences have a entropy of only ~1.5 bits per character (see http://en.wikipedia.org/wiki/Entropy_(information_theory)). So, to an attacker who knows (or guesses) that your passphrase is an English phrase, it has a strength of just 45 bits -- far lower than the original calculation, but still somewhat higher than the punctuation password.

For better security with a memorable passphrase, use a actual sequence of random words -- e.g. using http://world.std.com/~reinhold/diceware.html. The diceware approach can give ~65 bits of entropy with a 5-word passphrase -- significantly more than either of the above provide.

Bruce Schneier often talks about how switching to long memorable passphrases would be much more secure than short, randomized weird-looking passwords.
Now you see why.

"Not considering brute force" - that's exactly what these tools measure.
Obviously they dont try social engineering, or trying to discover if it's the user's first girlfriend's dog's birthday. The attacker might know that, but these tools don't.

What they do measure is simply the difficulty for a bruteforcing tool to crack it. Entropy, yes, but length can play an even more important part in making a password uncrackable.
so, in your case - yes, the 32-character, alpha-only passphrase is much stronger than the 8-character punctuation password.

I'm gonna try and do the maths here for a bit: (please correct me when I'm wrong):

If we assume standard US-style keyboard, there are 85 possible printable characters (possibly be able to scrape a few more, but lets go with this for now): lowercase letters + upper case letters + numerals + standard punctuation + space.
This grants ~6.3 bits strength per character; at 8 chars length the password gives you ~50.4 bits strength.
Note really very strong... Even if we throw in a few more "special" characters, you're not going to upgrade that very much.

Now, for your 32 character, alpha-only passphrase...
Let's assume lowercase and uppercase letters only (even though you didnt use any), plus a space (U+32). Not even numerals...
That gives you 54 possible characters, around ~5.8 bits per character. At 32 chars long, thats over 185 bits strength. Substantially stronger. And that's even without numerals, which are usually accepted even in "simple" password schemes.

Bruce Schneier often talks about how switching to long memorable passphrases would be much more secure than short, randomized weird-looking passwords.
Now you see why.

"Not considering brute force" - that's exactly what these tools measure.
Obviously they dont try social engineering, or trying to discover if it's the user's first girlfriend's dog's birthday. The attacker might know that, but these tools don't.

What they do measure is simply the difficulty for a bruteforcing tool to crack it. Entropy, yes, but length can play an even more important part in making a password uncrackable.
so, in your case - yes, the 32-character, alpha-only passphrase is much stronger than the 8-character punctuation password.

I'm gonna try and do the maths here for a bit: (please correct me when I'm wrong):

If we assume standard US-style keyboard, there are 85 possible printable characters (possibly be able to scrape a few more, but lets go with this for now): lowercase letters + upper case letters + numerals + standard punctuation + space.
This grants ~6.3 bits strength per character; at 8 chars length the password gives you ~50.4 bits strength.
Note really very strong... Even if we throw in a few more "special" characters, you're not going to upgrade that very much.

Now, for your 32 character, alpha-only passphrase...
Let's assume lowercase and uppercase letters only (even though you didnt use any), plus a space (U+32). Not even numerals...
That gives you 54 possible characters, around ~5.8 bits per character. At 32 chars long, thats over 185 bits strength. Substantially stronger. And that's even without numerals, which are usually accepted even in "simple" password schemes.

Bruce Schneier often talks about how switching to long memorable passphrases would be much more secure than short, randomized weird-looking passwords.
Now you see why.

"Not considering brute force" - that's exactly what these tools measure.
Obviously they dont try social engineering, or trying to discover if it's the user's first girlfriend's dog's birthday. The attacker might know that, but these tools don't.

What they do measure is simply the difficulty for a bruteforcing tool to crack it. Entropy, yes, but length can play an even more important part in making a password uncrackable.
so, in your case - yes, the 32-character, alpha-only passphrase is probably stronger than the 8-character punctuation password. But seeing why that is true is more interesting than just knowing which is stronger in this case...

I'm gonna try and do the maths here for a bit: (please correct me when I'm wrong):

If we assume standard US-style keyboard, there are 85 possible printable characters (possibly be able to scrape a few more, but lets go with this for now): lowercase letters + upper case letters + numerals + standard punctuation + space.
This grants ~6.3 bits strength per character; at 8 chars length the password gives you ~50.4 bits strength.
Note really very strong... Even if we throw in a few more "special" characters, you're not going to upgrade that very much.

Now, for your 32 character, alpha-only passphrase...
If we consider it to be a random sequence of lower case chars and spaces (27 possible characters, ~4.7 bits per character. At 32 chars long, that's over 150 bits strength. (If you selected randomly from uppercase chars too it would be over 180 bits strength.)

Substantially stronger. And that's even without numerals, which are usually accepted even in "simple" password schemes.

BUT

That punctuation-filled password isn't really a random series of 8 characters from the 85 printables. Its an l33t-sp34k version of "this val" with the standard substitutions i->1, s->$, space->., a->4. And "this val" is just a pair of common words. The entropy of this password is probably ~25 bits for the choice of the two words, and perhaps 5-10 bits for the choice of substitutions, for an overall complexity of ~35 bits.

And the passphrase isn't a random sequence of lower case chars and spaces, either. There are many more spaces than you'd expect, for a start. And lots more vowels. In fact, English sentences have a entropy of only ~1.5 bits per character (see http://en.wikipedia.org/wiki/Entropy_(information_theory)). So, to an attacker who knows (or guesses) that your passphrase is an English phrase, it has a strength of just 45 bits -- far lower than the original calculation, but still somewhat higher than the punctuation password.

For better security with a memorable passphrase, use a actual sequence of random words -- e.g. using http://world.std.com/~reinhold/diceware.html. The diceware approach can give ~65 bits of entropy with a 5-word passphrase -- significantly more than either of the above provide.

Bruce Schneier often talks about how switching to long memorable passphrases would be much more secure than short, randomized weird-looking passwords.
Now you see why.