You are making the same error that led to the popularity of passwords based on a common word and some substitutions. Your calculation is for 11 characters, eac

You are making the same error that led to the popularity of passwords based on a common word and some substitutions. Your calculation is for 11 characters, each chosen completely at random out of 63 symbols. People don't chose a password that way - we typically can't generate or remember random symbols. XKCD's calculation is for a common word + common symbol substitutions and additions: log2(#words) + log2(#capitalization options) + log2(#substitution options) + ...