In developing password policies, IT managers must strike a balance between security and
memorability. Rules that improve structural integrity against attacks may also result in
passwords that are difficult to remember. Recent technologies have relaxed the 8-character
password constraint to permit the creation of longer pass-“phrases” consisting of multiple
words. Longer passphrases are attractive because they can improve security by increasing
the difficulty of brute-force attacks and they might also be easy to remember. Yet, no …