@CatsofArrakis @protonprivacy When the words themselves are plentiful enough, have no discernable reason to be used together, and have at least a couple extra characters to poison the dictionary attack, then you're only going to be able to brute force it and at that point entropy is all that matters.

The only thing I'd change would be separating the words with just dashes. I think you could keep the password memorable enough by using something else or varying the separating characters.