Am I likely to see any practical increase in security by combining passphrases and leetspeak?

Question

(We really should just have a button to link this XKCD)

I've just started switching my passwords into passphrases. Now, I didn't roll any dice to come up with them, which I know sacrifices entropy; they're sentences. They're at least 25 characters long, at least 5 words, and I try to slip a number in there as well as a "fake" word (this would be either a bastardization of a word I make up or a non-standard word like "doggo" or "borked").

Now, I know the fact that I have a structure at all means I've lost potential entropy, but the message I got away from that XKCD is that memorizablity is a resource to be maximized as well as entropy. I appreciate that I can tell my wife these passwords without needing to ever write them down (or, god forbid, text/email them). I hope to never actually see an active password of mine.

My question, then, is Am I likely to see any practical increase in security by combining passphrases and leetspeak?

"Practical increase in security" here means additional protection from any attack vectors given modern hardware in a reasonable time period. I know leet-speak would obviously help, but if an attack on the passphrase alone is infeasible, I'd rather not complicate my password. This is in the average case; I'm not concerned with someone dedicating dozens of GPUs to my password alone for months on end.

You can make the assumption any changes would be easily memorized. I'm mostly curious if a passphrase provides enough entropy on its own that the traditional strategies for entropy are no longer relevant. As an example, is the second password here pragmatically any better than the first?

mydoggoShrekate7bonesyesterday
myd0ggoShr3k4te7bon3$yesterd@y

(Also, please don't just suggest a password manager. I have my reasons for wanting to avoid one.)

Answer 1

If memorability and readability is your goal, then the second version of your password (that is: myd0ggoShr3k4te7bon3$yesterd@y) is much more difficult to memorize, read, and communicate. So yes, it will definitely hamper and slow down most bruteforcing attempts based on word lists, but at the expense of memorability and readability.

It's hard to calculate the entropy of your password. I'm not sure I'm able to do it, but I'll try anyway, and if I'm wrong somebody will correct me.

If you google for "entropy of English sentence", you can find some articles citing Shannon's experiment to calculate the entropy of English. From what I read, it seems that on average the entropy can go from 0.6 bits to 2.5 bits per letter, depending on a lot of factors. Let's suppose your sentence has 1.5 bits per character. Some letters will have higher entropy because of your made-up words, other letters will have a lower entropy because they are part of very basic English words, so let's suppose on average it's 1.5 bits per character anyway.

30 characters x 1.5 bits = 45 bits

Now let's transform the pass phrase. For simplicity, we suppose we basically need to pick 7 letters and translate them to leet. Supposing only half of the letters have a leet equivalent, we need to pick 7 letters out of 15. And we need combinatorics, which if I'm not wrong (it's been a long time since math classes, sigh) leads to this:

15! / (7! (15-7)!) = 6435 possible groups of leet letters.

So to guess your leet password all those possibilities need to be bruteforced for each sentence, meaning that will add 12.65 bits of entropy (that is, log base 2 of 6435). It's a rough estimate, for example I didn't consider the fact that "a" in leet can be either "@" or "4", but I just assumed that every translatable letter could be translated to only one equivalent.

So, to recap, if I'm not wrong, and in an ideal world where the attacker knows how you build your passwords and where password crackers are optimized for the entropy of the English language instead of just bruteforcing ungrammatical bunches of words, we have the following entropies:

30-character sentence: 45 bits
30-character leet sentence: 57.65 bits
40-character sentence: 1.5 x 40 = 60 bits
5-word diceware pass phrase (about 30 characters) = 12.9 x 5 = 64.5 bits

Conclusion: I'd suggest using a longer sentence or better yet a true random pass phrase like diceware or similar, so you can easily achieve both higher entropy and at the same time readability and memorability.