Given that you're using a diceware list, I'll follow the one found here but this applies to any list (except for the average word size and some details in the instructions).
Properties of the diceware list
The instructions for using the diceware list make it clear that the overarching goal is to avoid bias when constructing a passphrase, starting from the use of dice and fixed list, down to the very specific instructions that should be followed to the letter. For example, it is specified:
If you do roll several dice at a time, read the dice from left to
So what do you gain if you follow these steps exactly:
- a random passphrase with easy to evaluate entropy
- no personal bias in the choice or order of words
- A blind brute force attack will need to crack a password of size approximately 4.2 (the average word length in the diceware list) times the number of words, plus spaces. Using even 4 words is making this infeasible.
- An attack knowing that you used diceware will be in similar dire straits. Each word added to the passphrase adds another 12.9 bits of entropy so 5 words is 64.5 bits. This will already be fairly strong.
- A dictionary or phrase attack will not do any better than the above attack since the set of words to try is exactly the diceware list and the random order does not make full phrases a good attack vector.
Modifying the passphrase
The simplest way to illustrate this is to use an (admittedly contrived) example.
Let's take the following six words obtained (in this order) by following the instructions:
But my memory is not doing so well these days and I can quickly massage these words into something much more memorable:
The quick brown fox jumps over the lazy dog.
This is presuming that I'm feeling free to change the order and insert words like
over, and punctuation.
Let's now look at our previous attacks:
- The blind brute force attack now has to deal with a much longer password and will do considerably worse.
- An attack knowing that you used diceware is now in hot water since either those words did not exist in the list, or the number of words massively increased as did the entropy.
- A dictionary or phrase attack is where we hit trouble. This is a fairly well known sentence, which is the reason it popped into my head.
For this exaggerated example, the dictionary attack with phrases might find my passphrase in very little time. This shows why bias in password selection can be a dangerous thing.
It comes down to two things: which attacks are being used, and how common your new passphrase is. You only control the latter.
My take on this would be to stick to the strict anti-bias rules of the diceware list. They are there precisely to avoid this kind of situation.
That said, your new passphrase may not be that much worse than the original but it's really hard to tell due to the very subjective nature of personal bias.
The instructions warn about this specific case:
You should also start over if your passphrase is a recognizable
sentence or phrase in the language you are using
They also allow for additional punctuation but also chosen randomly for both the type and the position. I've omitted mentioning them before since they can be considered part of the diceware method, though the same caveat applies for intentionally-placed punctuation.