But entropy is relative to an attacker (it measures the attacker's uncertainty about your password). The 1.2 bits/character measurement is about grammatical Eng

But entropy is relative to an attacker (it measures the attacker's uncertainty about your password). The 1.2 bits/character measurement is about grammatical English text that occurs in a communicative setting. That means that before you get there, you probably already know what word goes at the end of this sentence. You can measure this with human native speakers, or with a compression algorithm, or with a naive letter n-gram or word n-gram model, and get different statistics -- each of which is correct in the sense of each model's uncertainty about how the text continues. In the password setting, words can be used in all sorts of ways, some of which are very unpredictable to an attacker, so it's plausible that each word adds at least log₂(len(dictionary)) to the password entropy when it's chosen at random from a dictionary, even when the attacker expects that the password selection method could have used that dictionary.