How did a web comic change password advice?

In 2011, xkcd, a web comic, set two passwords side by side in strip #936. Tr0ub4dor&3, a dictionary word dressed up with substitutions, was hard to remember and fairly easy for a computer to guess. correct horse battery staple, four common words picked at random, was easy to remember and much harder to guess.

The idea was older. In 1995 Arnold Reinhold’s Diceware had people roll five dice to pick each word from a list of 7,776. It was a simple, checkable recipe for a strong passphrase, sixteen years before the comic. The dice matter because people are bad at being random: left to ourselves, we pick words that mean something, and attackers try those first. The Electronic Frontier Foundation, a digital-rights nonprofit, still recommends rolling dice for passphrases, with word lists of its own. Plenty of people copied the comic instead, and correcthorsebatterystaple has since turned up more than 4,000 times in leaked password lists.