I'm using a password manager to store unique passwords for all my accounts. Most of the passwords are auto-filled, auto-typed or can be copied and pasted, but occasionally, I have to type them manually (e.g. in-game accounts, certain mobile apps/services, etc.).
Since passwords like
VeS3XPTUs3w4PN8xGdmN can be a pain to type correctly manually, I have played around with password generator patterns in order to find something that's easier to "buffer" in memory while typing. I find that phrases that can be pronounced are much easier to remember than unpronouncable strings like the above.
For example, pattern that's easier to remember might be punctuation-delimited groups of alternating consonants and vowels:
vudu:ARUD;raxu,URAB:6527 give;ALEZ,jabu.ACUP,4722 kuge.UTUF,xura;EVEG.7334 kiro.AVAJ.vovo:AHAY;4786
I realize that any pattern will make the passwords easier to crack if an attacker figures out the pattern. For the examples above, I would guess that
- all the letter groups could just as well be lowercase, since the number of combinations are the same and whether a group is uppercase or lowercase is explicitly given by the pattern
- the number group at the end would be better as another letter group, since the pattern explicitly states whether it's numbers or letters, and a letter group following the pattern above would have (slightly) more combinations
In other words, the following examples might be a bit harder to crack for an attacker knowing the pattern:
vapu-dapu-fato-sovu-gazi mipi-rodo-qiba-tiwu-cihe qana-jeru-hibu-toka-xixu fuca-kigu-moka-koxu-yopu
At the same time, including both lowercase, uppercase, and numbers will make them more difficult to brute-force. Then again, if the passwords are this long, the last group of examples above might be sufficient anyway.
Is there anything I should know about before using such patterns for generating passwords? Specifically, could (or should) the pattern be improved, and could it be simplified without losing significant security (or alternatively, could one just as well use a nonsense sequence of real words)?