Apple Passwords’ generated strong password format

Looks like a good design

Doing something like randomly sampling a range of a-zA-Z0-9 and all the symbols without order or structure is absolutely the worse way of doing it for passwords that humans need to type/read, or in fact anything that might get tripped by special characters (like shell scripts, etc)

Yes yes you might lose a bit of entropy, just add one or two characters to it and it will make up for it. Passwords are not so much bruteforced from zero anymore rather than leaked from places with bad password hashes

I just opened the Password app for the first time to look at the generator. It seems like the pattern is: [a-zA-Z0-9]{6}\-[a-zA-Z0-9]{6}\-[a-zA-Z0-9]{6} with exactly only one uppercase char and one digit. I don't want to do the maths but that looks like a lot of removed entropy.

He mentions the entropy in the article...

Right, thanks. So from 160 bits down to 70 bits of entropy (there is also fancy syllables and bad words to take into account).

Quite the opposite

> these new passwords have 71 bits of entropy, up from the 69 from the previous format.

I am referring to the loss of entropy compared to a (theoretically) fully random 20-chars password.