> These passwords are not reselient to complicated attacks and are more easily cracked than randomly generated passwords.

There is no fundamental difference. Either your pool of elements consists of 95 different symbols (ASCII printable characters and space) and you get passwords like 'F~iV3Bcv>\Q@' or your pool of elements consists of thousands of words and you get passwords like 'hubs exempted contend catchment others'.

As per Kerckhoff's principle, we should assume that the method of generating the password is known (which set of elements, i.e. your charset or dictionary, which RNG was used, and perhaps the length of the password).

The resulting strength in terms of bruteforceability of its hash is equal. Assuming one picks sane values, e.g. 6 elements when using a 7800 element set, or 12 elements when using a 95 element set, both are safe to use.

> randomly generating 6 word passwords using Wikipedia as dictionary

I don't understand what you mean by "using Wikipedia as dictionary". Wikipedia contains whole sentences. Did you download a dump of the English Wikipedia and split it on non-word characters and use that as dictionary? Did you remove duplicate words? Or did you take Wiktionary's words?

> if you use words as your base unit then you only need to find 4-6 from a fairly limited pool of possibilities.

I think you're wrong, but feel free to prove me wrong :). Here are some hashes:

f4cd51713a3ac5798b3a0b40fe61aa2f
f424f3432b7acbce2c2d3548490c9cc0
71fa597116bfc54ecc6c48162629d391
beb09edbc493bf826b61afa6905712df
42251a29996a78ef023bdb03a8c22ea9
3a80f15bd82c4f4c0a3338a1fa86adb9

They were generated using this script:

function genphrase {
x=$1;
while [ $x -gt 0 ]; do
echo -n $(shuf /usr/share/dict/words | grep -v é | grep -v \' | tail -1)\ ;
let x=$x-1;
done;
}

for i in {1..6}; do
phrase="$(genphrase $i)";
sum=$(echo -n "$phrase" | md5sum | awk '{print $1}');
echo "$sum $phrase";
done;

Basically I take random words from /usr/share/dict/words so long as it does not contain an apostrophe or an accented e. The md5 hash of the result is generated, a very fast and well-supported algorithm (your favorite cracking program should support it without any trouble). As an example, from another run of the script, here is one of its output lines:

75e6881687661e09e404b517e7ee2ce3 goodliest villeins gymnast

You can use this sample output to verify that the hash is generated correctly and that your tool works. I expect the first two hashes should not be an issue, the third might be harder, the fourth would be impressive, and I expect that the fifth and sixth will remain uncracked.

The dictionary version is 2018.04.16-1 (wamerican package in Debian), I uploaded it here: https://lucb1e.com/tmp/words (watch out clicking the link, it's a large file and your browser may just display it instead of downloading it)

> You can further limit it down by using grammar rules if your target is using passphrases those are even faster to crack and can be generated using markov chains or any basic grammar rule engine.

At least in my research, I've found that markov chains and n-grams are of much worse quality and slower than just using raw phrases from public sources. The downloading and processing of those sources takes more time, but that's a one-time action and not really part of the cracking process. And as I said in the comment you're replying to, if your 'phrase' is not random words but actually a logical 'phrase', then it's not suitable as passphrase. I think you're confusing random phrases with logical sentences.