If you're using Kolmogorov complexity as your measure of entropy, then the entropy is given by the shortest program required to produce the output. So yes, in y

If you're using Kolmogorov complexity as your measure of entropy, then the entropy is given by the shortest program required to produce the output. So yes, in your example, you would need to include the code in the entropy measure. This is still kinda subtle though, because computing SHA obviously requires a fairly complex program -- and yet, if your program had consisted of a single SHA and nothing else, it would be far less secure. Why? I think it's because the security of a password doesn't depend purely on its Kolmogorov complexity, but rather something like its...distance from a Shelling point? SHA is complicated, but it's also so common that you can invoke it in your shell with six letters. So a single application of SHA is not far from a Shelling point. If you had used a modified SHA, say tweaking one of the constants involved, then your password would immediately become much harder to guess. And yet your modified SHA could have the exact same Kolmogorov complexity as the unmodified version. (Obviously, random or secure pseudorandom passwords fit this definition as well, since a random string is not close to any Shelling point.)