(We really should just have a button to link this XKCD)
I've just started switching my passwords into passphrases. Now, I didn't roll any dice to come up with them, which I know sacrifices entropy; they're sentences. They're at least 25 characters long, at least 5 words, and I try to slip a number in there as well as a "fake" word (this would be either a bastardization of a word I make up or a non-standard word like "doggo" or "borked").
Now, I know the fact that I have a structure at all means I've lost potential entropy, but the message I got away from that XKCD is that memorizablity is a resource to be maximized as well as entropy. I appreciate that I can tell my wife these passwords without needing to ever write them down (or, god forbid, text/email them). I hope to never actually see an active password of mine.
My question, then, is Am I likely to see any practical increase in security by combining passphrases and leetspeak?
"Practical increase in security" here means additional protection from any attack vectors given modern hardware in a reasonable time period. I know leet-speak would obviously help, but if an attack on the passphrase alone is infeasible, I'd rather not complicate my password. This is in the average case; I'm not concerned with someone dedicating dozens of GPUs to my password alone for months on end.
You can make the assumption any changes would be easily memorized. I'm mostly curious if a passphrase provides enough entropy on its own that the traditional strategies for entropy are no longer relevant. As an example, is the second password here pragmatically any better than the first?
mydoggoShrekate7bonesyesterday
myd0ggoShr3k4te7bon3$yesterd@y
(Also, please don't just suggest a password manager. I have my reasons for wanting to avoid one.)