when it comes to password strength, the number you are really interested in is something like probability of the password being generated by a naive human. Meas

when it comes to password strength, the number you are really interested in is something like probability of the password being generated by a naive human. Measuring raw entropy basically assumes that the only one non-random thing a user can do is repeat a character. for example, by the p*log(p) measure `1234567890abcdef` and `936a0ce28b1d74f5` both have log(16!) bits of entropy, yet one of them is much easier to guess than the other.