• This is only really bad for people using password managers, and even then I’d argue 16 characters was quite sufficient.

    Neither phrases or words differ with regard to getting unmanaged users to use different pass-codes on different sites.

    Incidentally, your DISQUS comment system requires 3rd-party cookies, which is irritating as hell.