I'm not sure how it's counter-intuitive, though. Maybe my intuition just works differently from most folks, but it seems self-evident that there's some point at

I'm not sure how it's counter-intuitive, though. Maybe my intuition just works differently from most folks, but it seems self-evident that there's some point at which a larger string of characters from a smaller alphabet has more entropy than a smaller string from a larger alphabet. It's relatively simple combinatorics that doesn't need a sophisticated analysis to demonstrate. What bothers me is that so many people's intuition is wrong, which leads to ridiculous policies. I'd have much more respect for a policy that tells me "our minimum password length is 20 characters" than for the more usual policy that states "our minimum password length is 8 characters, and for security reasons passwords must contain at least one capital letter, one number and one special character, and no characters can repeat, and this must be different from your last 18 passwords, and this password will expire in 30 days..."