At first glance, this seems like it might be a good idea. Like many suggestions
relating to passwords, in some situations it may even be an OK solution. However,
when you consider it in more detail, a number of shortfalls become evident.
If I was trying to crack someones password, one of the first things I would do is try
to find out as much information about the person as possible. If I know you are a
programmer, then I may well take a guess that you use some code for your
passphrase. I've now narrowed down the possible search space.
If I know what your preferred programming language is, I've now reduced the search
space even further. I only need to consider legal forms from your preferred
Now when I consider the legal forms which are allowed in your preferred language,
I've reduced the search space even further. If there is a known maximum character
limit for the passphrase, that search space is even smaller again - in fact, for most
languages, there will only be a very small set of possible legal forms which will fit
in to the allowed character limits for many passwords.
As indicated by other answers, the real problem with 'clever' password/passphrase
schemes is that they rely on others not being able to guess what your scheme is. As
the popularity of a scheme increases, the benefit of that scheme reduces. Above all,
any scheme you choose needs to be something which is not easily associated with
The other problem with clever password schemes is that they are rarely as clever as
you think theyy are. If you analyse passwords dumped from stolen password
repositories, you will be surprised how 'common' many of these clever schemes
are. You may also be surprised how often the clever scheme is related to the domain
the passwords came from. For example, I saw passwords stolen from an Air Force system
and guess what, the vast majority of passwords were either derivations of various
aircraft names and model numbers or character names from movies or books with a
military or air force theme. Likewise, passwords dumped a couple of years ago from a
christian dating sight had large numbers of passwords which included phrases, chapter
and verse numbers from the bible. If I was going to try and crack github passwords, I
would almost certainly look at code as a possible pattern.
The one minor benefit of using code is that you will likely have a longer
password/passphrase, which is often as important or more important as the underlying
complexity. Too often, people use short passwords because they are easy and quick to
type. These days, I think most people are far better off ensuring that they use
either 2 factor authentication or 2 step authentication whenever possible and use a
password manager which will generate random passwords for you and in most cases,
eliminate your need to remember them.