[jjk166]

Yeah, for a given level of entropy words are a better choice, but the fact is that dictionary attacks greatly reduce the efficacy of what could be an incredibly strong password if they can safely assume it is formed exclusively from concoctenated standard words. However if you break the validity of that assumption by using a word that's not on a list, then the dictionary attack must be combined with a brute force attack with the same string length. If we assume an average word length of 5 letters, that 7 word password jumps to 1.22x10^79 possible combinations if you randomly substitute one letter.