People say don't use passwords in the dictionary but if you use two
words isn't it alright?
Let's backup a bit. There is nothing wrong with using several dictionary words to create a passphrase. After all, the Diceware system uses nothing but dictionary words. However, there is everything wrong when those dictionary words are not chosen randomly. And by random, I don't mean you dreaming up 7 words out of your head.
Now, if you took any dictionary and...
- randomly chose a page number,
- randomly chose a column on the page, and
- randomly chose an entry in the column
then your passphrase, created from your list of words, will have the maximum entropy (uncertainty, chaos, guess-factor) possible.
Strong passwords/passphrases are strong because they have a lot of entropy. Entropy is a product of the creation mechanism, not the passphrase contents! That's why every password you ever concocted in your head is basically worthless, because it has so little entropy, because the creation mechanism was not a random one.
Unconvinced? Let's try an example with an online analyzer that can measure the difference in entropy between a randomly made password and a "human" password. Let's analyze Cool Super Password.
And because we're so clever, we will change it up a little to k0Ol suP@h p4$$wUrd.
Now, on its face, if this were 100% randomly created, this 9519 keyspaced passphrase would clock in at around 112.34529 bits, because each symbol would have about 6.5699 bits of entropy (6.5699 × 19 graphemes). That's a max. (Set the analyzer to calculated Uncertainty to see this.)
But... I just made this passphrase up; it's not really random at all. So, I can't objectively assign each symbol that much entropy. I have to go with something closer to reality like 2.3 bits of entropy per symbol (Shannon, 1948). And if I were feeling merciless, I would choose 1.1 bits of entropy (Takahira, 2016), but let's use the 2.3 metric. (The analyzer lets you choose.)
At 2.3 bits per symbol, I have no more than 39.33 bits of total entropy. My 19-character passphrase is garbage, and would take a Brutalis about 987 milliseconds to crack! (See in analyzer).
The difference between a random password, and a human one, cannot be stressed enough. The issue is not whether you use dictionary words in your passphrase, the issue is how those words are selected. It's all about the creation mechanism, not the contents.
[DISCLAIMER] I created the passphrase.Life analyzer [/DISCLAIMER]