On https://passwordsgenerator.net/, it says
Examples of weak passwords: qwert12345, Gbt3fC79ZmMEFUFJ, 1234567890, 987654321, nortonpassword
The first, third, and fourth examples are obviously weak. I can't, however, see what's weak about the second one.
Indeed, the only problem I see with it at the moment is that it doesn't have any special symbols. Is that enough for a password to be considered weak?
I was curious about the same thing, so I put Gbt3fC79ZmMEFUFJ into Google, and lo! and behold it found something that wasn't just a paraphrase of "Don't use this password" advice — the password itself was embedded in example source code that showed how you could send a password to a server! (link to page, and screenshot below)
So I think the real goal of that advice is not that Gbt3fC79ZmMEFUFJ is a mysteriously weak password because of the keyboard layout or because of low entropy or because it doesn't include symbols or Unicode or emoji or whatever: It's simply to remind you that you should never use a password that's been published somewhere, especially one published as an "example" password!
[Update: This is intentionally a screenshot and not simply a code snippet; the content of the code is far less important than seeing how it appeared verbatim on somebody's website!]
As you noticed, it doesn't have any symbols, which makes it weaker than a password of similar length which does, but there's no other 'obvious' defect with this password. A password does not have to use symbols to be strong, as long as it's long enough (obligatory XKCD link).
But, now that this password appears in plain text on a website (dedicated to passwords), it's likely that some attackers will include it in their dictionary. After all, there might be users less proficient in English, or audacious types, who still use this password since it looks random and reasonably long. In this way, saying "Gbt3fC79ZmMEFUFJ is a weak password" is some kind of self-fulfilling prophecy.
There is nothing wrong with this password, other than it being published somewhere on the internet. The password is 16 characters of varying upper case, lower case, and numbers. This equates to a search space of 6216, or about 95 bits of entropy. This is massive, and can't be brute forced.
So why did the author of this website consider it a bad password? Being published on the internet is unlikely to be the reason. A list of "good passwords" is also included, which are obviously also published on the internet, making them immediately "bad passwords" using this line of thinking.
The most likely scenario is the author doesn't understand password entropy, and thinks that passwords MUST contain special characters. This is simply false. Entropy is a function of the number of possible symbols, AND length.
If generated at random, the entropy (in bits) can be calculated by log2(number-of-symbolslength). For an alpha-numberic with variable case, this is simply log2(6216), or about 95.
The rub is of course most passwords are NOT generated at random, so this simple formula isn't often useful.
It looks like the password is made up of runs of randomly typed characters on a QWERTZ/QWERTY/AZERTY keyboard that are highly clustered together. This is most pronounced on a QWERTZ keyboard:
Image based on KB Germany.svg from Wiki Commons.
Here, the coloured keys are those of the password with the hue indicating its position in the password (going from blue to green). You see that the characters cluster together, and this is even more pronounced for characters of similar hue (i.e. characters that are are close to each other in the password). In addition to that, the clusters seem to clump near the home position on the keyboard.
I must admit that I am not knowledgeable enough about password cracking software / password databases to say definitively whether or not such clusters are taken into account, but it is at least something that I noticed myself when I try to type random characters on the keyboard that they don’t actually come out very random in the end. And if I have noticed that, probably some author of some password database has, too.
The complete paragraph is:
- Do not use any dictionary word in your passwords. Examples of strong passwords: ePYHc~dS*)8$+V-' , qzRtC{6rXN3N\RgL , zbfUMZPE6`FC%)sZ. Examples of weak passwords: qwert12345, Gbt3fC79ZmMEFUFJ, 1234567890, 987654321, nortonpassword.
So it looks like it should be an example of a bad password because it uses "dictionary words". At first sight, I cannot recognize any words there. However, I tried to look up its parts on Wikipedia (English), and it looks like there are articles for all of its parts.
However, this would be pretty far-fetched. It would be like saying that, considering Wikipedia as your dictionary for words, a six-word passphrase would be insecure. No way! A six-word passphrase with random entries from Wikipedia would be very secure.Of course you can say that that password is now insecure because it's written on the internet, but that would have been true of every other possible example then, even for the examples of strong passwords. I also tried looking it up on haveibeenpwned, and the result was: "This password wasn't found in any of the Pwned Passwords loaded into Have I Been Pwned". Another explanation, which is probably the real reason why that example was given, is that the password can be found online in some code if you Google it (see here), as was pointed out in another answer. So by "dictionary password", the authors maybe meant "any password that has ever been written somewhere, including the internet". However this is yet again nonsensical advice: how are you supposed to follow that advice? Should you start looking up your password in lots of places (including Google, maybe even leaving traces in history), just to be sure it doesn't already appear anywhere? That doesn't sound like a great thing to do.
In conclusion: it's a bad example and it's been given in the wrong context. People are going to see that and interpret it like "oh, there are no symbols, I should use symbols". The real reason why it's been included in that list is unknown though, and there appear to be no explanations that truly make sense. If someone felt like wasting some time, they could try contacting the owner of that website and ask them.
This is a misleading statement. "Gbt3fC79ZmMEFUFJ" is a strong password in practice. It won't be caught by anything but a brute force attack on it (no dictionary words) and it's sixteen characters, which is way above the common standards I see (8 or 6). This password might only be considered weak if the attacker somehow knew no symbols were used. If the account this password is attached to publicly says "only numbers and cap/lowercase letters" then this password might seem weaker for the sake of making an example, but it's actually still better than an 8 digit password.
So, for a 16 character password using capital letters, lowercase letters, and 0-9 digits, entropy is 6216 = (48 × 1027) vs using an 8 characters password with all symbols (we'll even assume 96, not 72 characters) is 968 = (7 × 1015). This is a massive difference.
The reason for this confusion is the example is oversimplifying the basic advice to use a capital, lowercase, digit, and symbol. In actuality, the length of the password is far more critical and also in practice the attacker would not be able to know that the full character set wasn't used and would actually still have to brute force 9616.
While Gbt3fC79ZmMEFUFJ is certainly a poor choice of password now, seeing that your question has generated a lot of activity on Stack Exchange and has thus widely published the password, I don't think there is any discernible reason we can pin down for why this website would say it's bad in the first place, because, quite frankly, it is not a credible source.
The source that you're drawing from appears to be a loosely organized list of security tips of low to middling quality. Some of the tips are good (e.g. use 2-step authentication whenever possible, lock your computer and mobile phone when you leave them), but some of them have been questioned by security experts (e.g. change your passwords every 10 weeks, use at least one uppercase/lowercase/number/symbol) and quite a few seem downright paranoid (e.g. tip 22, which states that if you have a WiFi router in your home, nearby attackers can detect what passwords you're typing in because of changes in the WiFi signal from moving your hands, and that using an on-screen keyboard with random layouts will mitigate this).
And while it is probably not an issue that most of the tips are poorly proofread (with many spelling errors and punctuation inconsistencies), it is an issue that absolutely none of the tips are cited, and that the whole website is anonymous. There are no quotes from security experts, no articles that we can read up on for further information or discussion. And the website contains absolutely no author information - nowhere on the website, or even in the website's Whois registration, is there any way to contact the author or even know who they are.
This essentially means that we have little to no way of determining how good of a tip "Gbt3fC79ZmMEFUFJ is a weak password" is, or what it even means. We certainly have no way to contact the author of this website and ask them ourselves, and I actually doubt that it would even be useful to do so. I think that we are best off ignoring this suggestion, taking way only the fact that Gbt3fC79ZmMEFUFJ should not be used because we have talked about it at such length.
TL;DR: Passwordsgenerator.net is just another anonymous stranger on the Internet - just ignore it.
As an addendum, you may be interested in some other things I found when I was inspecting the website itself, to get better context on what it was and perhaps find more information on it. What I found wasn't very pleasant:
Math.random()! Math.random() is a cryptographically insecure random number generator, making the generated passwords surprisingly predictable and actually far fewer in number than you'd be led to believe - for instance, if your implementation of Math.random() has only 32 bits of state, then regardless of what settings you use, only 4 billion unique passwords can be generated, which means that any number of characters beyond 7 or so is meaningless. A true random password generator should instead use the window.crypto.getRandomValues() call instead, which sources every single bit of the password from a true entropy source somewhere in the computer.window object - but any presence of actual ads will also potentially compromise any data entered into the page, even if the page is served over HTTPS. 
Most people have been distracted by the strength/entropy of the password (it looks like something most password managers would spit out). The reason why the top answer's find makes your password weak is that it is almost certain to be part of a database of known passwords
"It's vastly different than it was [before] because of these massive password lists," said Rob Graham, CEO of penetration testing firm Errata Security. "We never had a really large password list to work from. Now that we do, we're learning how to remove the entropy from them. The state of the art of cracking is much more subtle in that before we were guessing in the dark."
If someone has a data breach, crackers will start with the known list of passwords and work backwards from there. That's why password managers are the new standard of security: you generate a random and unique password every time.
Strong or weak is somewhat arbitrary as it's based on length of time it would take to randomly guess it, which is a function of the entropy of the password. You can make it take longer by increasing character length, or increasing the pool of characters that can be in the password.
In the example you provide that's just upper/lower/digits, so that's a character set of 62. There are 16 characters, so that's 6216 guessable combinations. Adding special symbols (let's just say 10), that puts the combinations up to 7216.
Trying every single combination is a bit naive, but it's the most expensive attack, so you have a baseline to operate against.
The website considers Gbt3fC79ZmMEFUFJ to be "weak" because of paragraph 2 on the same site: "Use a password that has at least... one special symbol." This example doesn't have a symbol, so the author says it's weak.
As others have pointed out, Gbt3fC79ZmMEFUFJ should not be considered for no other reason than it's been published on the internet. That fact alone effectively drops its entropy to zero. And low entropy credentials are worthless. Now, if it weren't already published, it may be instructive to analyze it a bit, to see how much entropy it could have had.
The keyspace is 6216 or 4.77 × 1028 permutations. (The complexity is 62, the length is 16.) Now, if we pretend the password resulted from a bonafide random process (rolling casino dice, using a CSPRNG, etc.) then each of the 16 symbols would be assigned 5.9542 bits of entropy, using log base 2. (Typing Math.log2(62) into your javascript console will easily show you this.) Total complexity would be 5.9542 multiplied by length, or roughly 95.2672 bits. In other words, that's a password with a strength of 295.2672 which is a winner in anyone's book.
That's max entropy, and Gbt3fC79ZmMEFUFJ would only have that much entropy if:
But let's look at the other extreme and pretend the password was created by any non-bonafide random process, as in, somebody just made it up in their head.
In a non-random process, prevailing wisdom suggests that entropy is much lower, as in about 2.3 bits per character (Shannon, 1950). That's a far cry from almost 6 bits! (In fact, newer analysis drops it down further to 1.1 bits per character, as published in 2016 by Takahira, et al.)
So, if we run with the presumption of 2.3 bits per character, total entropy for Gbt3fC79ZmMEFUFJ would be about 37 bits (36.8), and take 59,823,779,182 guesses, on average, to discover. This is horribly weak, of course. Unless you know beyond a doubt a password was created randomly, you should presume it wasn't, and assign a lower entropy (2.3 bits) to each character.
But... it doesn't have any symbols, you say. Surely Gbt3fC79ZmMEFUFJ would be much harder to crack if it had some of those special symbols. Would it? Let's see...
Let's modify Gbt3fC79ZmMEFUFJ to Gbt3fC79ZmME-*,J. The complexity of our 16-character password now jumps to 95, and keyspace is 9516 or 4.40 × 1031 permutations. Made randomly (having maximum chaos or entropy), the password's strength is of course stellar. Made non-randomly, it sucks. You see, adding the symbols -*, didn't improve the fact that character entropy is still just 2.3 bits each, and total entropy would still be about 37 bits, and take 59,823,779,182 guesses, on average, to discover.
All that to say this, one cannot look at a password and "eyeball" it's strength—it must be analyzed. Entropy is not a function of the contents of the password, it's a function of the creation process itself.
To drive this point home consider that passwords created from a bonafide random process may also contain harmful patterns. The 12‑character term q\UD73b9(Js^ is both 100% random and 100% worthless. It happens to match a very common topology pattern (lsuuddldsuls), and every password in the topology—all 11 quadrillion of them—will be butchered in under 9 hours!
