This is nifty but I don't think implemented the way you'd want it to be. You say you're basing it -- or are inspired by -- the xkcd comic. But the xkcd comic g

This is nifty but I don't think implemented the way you'd want it to be. You say you're basing it -- or are inspired by -- the xkcd comic. But the xkcd comic gets this calculation more-or-less right. Entropy is not a property of the character set used to generate the password, it's a property of the rule-set used to generate the password. Look at the comic: the "Tr0ub4dor&3" password isn't 11 random characters chosen from a set of 72 possibilities, and "correct horse battery staple" isn't 28 characters chosen from lower alpha + space. The difficulty in calculating password entropy is that it's unclear whether or not the rule set will be known to the attacker or not. So an attacker which attempts "arbitrary length lowercase characters" will have a much harder time with "correct horse battery staple" than one that knows "exactly four common english words in lowercase separated by spaces." Or, put differently, if you know someone has a numeric four-character bank PIN and they submit 1979, do you think this was four randomly chosen digits or do you think the entropy is effectively reduced by an obvious ruleset used to generate it? Because you rely on character set validation, except for your clever cheat to artificially reduce the entropy of repeated characters, you will nearly always overstate the entropy of the password. A sort of very naive naive refinement of the problem is that you want an engine that, knowing a password, finds the feasible lowest entropy ruleset that could generate the password and is human reasonable. I include the qualifier "feasible" because via overfitting even random characters have a lowest entropy ruleset (e.g. if by chance the third character is capitalized and the 18th is not, we should not assume that the same rules applied again would generate this property) If you find this unsatisfying because the problem is open ended, I'd at least caution you that the entropy values as stated are at best an indication of how long it would take a brute-force character search to break the password, not how long it would take an even modestly informed adversary to do so. Hope this guidance turns the cogs a little.