I wonder if someone has done a similar analysis of HSXKPasswd. https://github.com/bbusschots/hsxkpasswd

Note the "pronounceable" caveat in the original message. Still important to note, but the implementation above is not at risk.

mind the options

http://www.openwall.com/lists/john-users/2010/12/07/3