I haven't had the time to read the full article, however I think I might have an answer to your question. The entropy computes the strength of the algorithm use

I haven't had the time to read the full article, however I think I might have an answer to your question. The entropy computes the strength of the algorithm used to generate passwords, not the strength of the password itself. So basically, you are getting the strength of the password if the attacker knows the algorithm. I couldn't find a better source than this stackexchange thread : https://security.stackexchange.com/questions/167235/how-does-the-password-tr0ub4dor3-have-28-bits-of-entropy https://security.stackexchange.com/questions/167235/how-does... Hope it helps