Ndtyhij

As you noticed, it doesn't have any symbols, which makes it weaker than a password of similar length which does, but there's no other 'obvious' defect with this password. A password does not have to use symbols to be strong, as long as it's long enough (obligatory XKCD link).

But, now that this password appears in plain text on a website (dedicated to passwords), it's likely that some attackers will include it in their dictionary. After all, there might be users less proficient in English, or audacious types, who still use this password since it looks random and reasonably long. In this way, saying "Gbt3fC79ZmMEFUFJ is a weak password" is some kind of self-fulfilling prophecy.

It looks like the password is made up of runs of randomly typed characters on a QWERTZ/QWERTY/AZERTY keyboard that are highly clustered together.
This is most pronounced on a QWERTZ keyboard:

Image based on KB Germany.svg from Wiki Commons.

Here, the coloured keys are those of the password with the hue indicating its position in the password (going from blue to green).
You see that the characters cluster together, and this is even more pronounced for characters of similar hue (i.e. characters that are are close to each other in the password). In addition to that, the clusters seem to clump near the home position on the keyboard.

I must admit that I am not knowledgeable enough about password cracking software / password databases to say definitively whether or not such clusters are taken into account, but it is at least something that I noticed myself when I try to type random characters on the keyboard that they don’t actually come out very random in the end. And if I have noticed that, probably some author of some password database has, too.

There is nothing wrong with this password, other than it being published somewhere on the internet. The password is 16 characters of varying upper case, lower case, and numbers. This equates to a search space of 62^16, or about 95 bits of entropy. This is massive, and can't be brute forced.

So why did the author of this website consider it a bad password? Being published on the internet is unlikely to be the reason. A list of "good passwords" is also included, which are obviously also published on the internet, making them immediately "bad passwords" using this line of thinking.

The most likely scenario is the author doesn't understand password entropy, and thinks that passwords MUST contain special characters. This is simply false. Entropy is a function of the number of possible symbols, AND length.

If generated at random, the entropy (in bits) can be calculated by log2(number-of-symbols^length). For an alpha-numberic with variable case, this is simply log2(62^16), or about 95.

The rub is of course most passwords are NOT generated at random, so this simple formula isn't often useful.

The complete paragraph is:

5. Do not use any dictionary word in your passwords. Examples of strong passwords: ePYHc~dS*)8$+V-' , qzRtC{6rXN3NRgL , zbfUMZPE6`FC%)sZ. Examples of weak passwords: qwert12345, Gbt3fC79ZmMEFUFJ, 1234567890, 987654321, nortonpassword.

So it looks like it should be an example of a bad password because it uses "dictionary words". At first sight, I cannot recognize any words there. However, I tried to look up its parts on Wikipedia (English), and it looks like there are articles for all of its parts.

GBT, 3f, C79, Zm, MEF, UFJ.

However, this would be pretty far-fetched. It would be like saying that, considering Wikipedia as your dictionary for words, a six-word passphrase would be insecure. No way! A six-word passphrase with random entries from Wikipedia would be very secure.Of course you can say that that password is now insecure because it's written on the internet, but that would have been true of every other possible example then, even for the examples of strong passwords. I also tried looking it up on haveibeenpwned, and the result was: "This password wasn't found in any of the Pwned Passwords loaded into Have I Been Pwned". Another explanation, which is probably the real reason why that example was given, is that the password can be found online in some code if you Google it (see here), as was pointed out in another answer. So by "dictionary password", the authors maybe meant "any password that has ever been written somewhere, including the internet". However this is yet again nonsensical advice: how are you supposed to follow that advice? Should you start looking up your password in lots of places (including Google, maybe even leaving traces in history), just to be sure it doesn't already appear anywhere? That doesn't sound like a great thing to do.

In conclusion: it's a bad example and it's been given in the wrong context. People are going to see that and interpret it like "oh, there are no symbols, I should use symbols". The real reason why it's been included in that list is unknown though, and there appear to be no explanations that truly make sense. If someone felt like wasting some time, they could try contacting the owner of that website and ask them.

This is a misleading statement. "Gbt3fC79ZmMEFUFJ" is a strong password in practice. It won't be caught by anything but a brute force attack on it (no dictionary words) and it's sixteen characters, which is way above the common standards I see (8 or 6). This password might only be considered weak if the attacker somehow knew no symbols were used. If the account this password is attached to publicly says "only numbers and cap/lowercase letters" then this password might seem weaker for the sake of making an example, but it's actually still better than an 8 digit password.

So, for a 16 character password using capital letters, lowercase letters, and 0-9 digits, entropy is 62^16 = ( 48 x 10^27 ) vs using an 8 characters password with all symbols (we'll even assume 96, not 72 characters) is 96^8 = (7 x 10^15 ). This is a massive difference.

The reason for this confusion is the example is oversimplifying the basic advice to use a Capital, lowercase, digit, and symbol. In actuality, the length of the password is far more critical and also in practice the attacker would not be able to know that the full character set wasn't used and would actually still have to brute force 96^16.

Most people have been distracted by the strength/entropy of the password (it looks like something most password managers would spit out). The reason why the top answer's find makes your password weak is that it is almost certain to be part of a database of known passwords

"It's vastly different than it was [before] because of these massive password lists," said Rob Graham, CEO of penetration testing firm Errata Security. "We never had a really large password list to work from. Now that we do, we're learning how to remove the entropy from them. The state of the art of cracking is much more subtle in that before we were guessing in the dark."

If someone has a data breach, crackers will start with the known list of passwords and work backwards from there. That's why password managers are the new standard of security: you generate a random and unique password every time.

Strong or weak is somewhat arbitrary as it's based on length of time it would take to randomly guess it, which is a function of the entropy of the password. You can make it take longer by increasing character length, or increasing the pool of characters that can be in the password.

In the example you provide that's just upper/lower/digits, so that's a character set of 62. There are 16 characters, so that's 62^16 guessable combinations. Adding special symbols (let's just say 10), that puts the combinations up to 72^16.

Trying every single combination is a bit naive, but it's the most expensive attack, so you have a baseline to operate against.