text: Q:
  
  How effective are password checking websites?
  
  I typed the following password in howsecureismypassword.net:
  yummy candy yummy
  
  It said it would take 100 billion years for a personal computer to crack. Is this accurate? Even though it has English words (that are related moreover) it is more secure than a random string of length 14? 
  If this is true everyone should be making passwords like this.
  
  A:
  
  A little test at the site you mentioned suggests they're considering length, alphabet, and brute force attacks only.  The password you posted does indeed return an answer of 100 billion years.  Changing it to "yummy candy yum" returns 'only' 49 million years.  An eight character word, with or without numbers, returns eleven minutes.  Adding one symbol changes the answer to three hours.  So, probably a relatively unsophisticated algorithm.  Everything happens in JavaScript, but it is minified and I didn't slog through it.
  Sadly for users for passwords, which is almost everyone, crackers of passwords have a surprisingly large number of heuristics and they've learned to harness GPUs to parallelize guesses.  Ars Technica did a series of articles on this in 2013.  Rather than post a half-dozen links, try this: https://www.google.com/search?q=password+cracking+site%3Aarstechnica.com
  So, your question breaks down into two parts: How many bits of entropy in a password, and how long does it take to crack a password with n bits of entropy?  You can get a good example of "bits of entropy" in the XKCD comic mentioned by others.
  People have four vocabularies: the vocabulary of words they use in speech, the vocabulary of words they understand in speech, the vocabulary of words they use in writing, and the vocabulary of words they understand in writing.  (The separation of spoken understanding and written understanding may be a little controversial but it really doesn't matter for the purpose of this discussion; I'm going to argue that speaking and reading vocabularies are the important ones.)
  I have long suspected that the average American's speaking English vocabulary is about a thousand words.  I just spent some time looking for evidence or research and came up empty.  However, Mark Burnett found that 91% of all passwords come from a list of just 1,000 items. (https://xato.net/passwords/more-top-worst-passwords/)  That supports my conjecture as well as a fair amount of research might do.
  So, if I asked an "average American" to pick a random word, that's probably about ten bits of entropy.  Randall Munroe (XKCD author) suggests using a list of 2,000 random words to generate pass phrases, so each word is about eleven bits of entropy because log2(2048) is 11.
  Note that the password selection has to be random.  Password crackers take human biases into account in their heuristics.  One way to pick random words from a list is with Diceware.
  We can think about entropy of characters instead of words.  There are 95 printable ASCII characters, and so, about that many one could type into a password.  Log2(95) is about 6.6, so, if characters are chosen randomly, an eight character password gives about 53 bits of entropy.  However, as Munroe points out in the comic, we rarely choose characters randomly; we pick a pattern, and that cuts entropy drastically.  (I do note that password manager programs can choose randomly from an alphabet, or at least pseudo-randomly.)
  Given a way to estimate the number of bits of entropy in a password, how long to crack n bits?  If we've done the entropy estimate accurately, that accounts for the heuristics used by the crackers, and we can simplify to brute force cracking.
  For fast hashes and no salting, this Ars Technica article estimates up to eight billion guesses per second.  Eight billion is 233. So, 33 bits of entropy will take one second, 34 bits, two seconds, and so on.  A pass phrase with 44 bits of entropy will take 211 seconds, or about half an hour.  If you get to 66 bits of entropy, six words from Munroe's hypothetical list or about ten random characters, that's 48 days 272 years.  
  It is important to note that the eight billion guesses/second is based on the passwords having been stored unsalted and using a fast hash like SHA-1.  If passwords are stored properly, using a random salt* and a key-stretching algorithm, then the brute force attack is reduced to thousands of guesses per second instead of billions.  There are details at Crackstation.  Sadly, we cannot depend upon people who run systems to store passwords "right," and so it is very important not to re-use passwords.
  So, to (finally!) get to the question that was asked, "yummy candy yummy" probably has about 30 bits of entropy.  A random 14-character string has about 6.6 * 14 = 92.4 bits of entropy, more than 262 or a quintillion times more secure.
  * A salt (see the Crackstation article) doesn't make it harder to crack a single password; it's purpose is to prevent precomputation attacks, where one set of computations cracks all or most passwords in a sample.
  
  