That's basically right for passwords. Of course, if we impose password complexity requirements (e.g. must have a digit or an uppercase letter), it actually red

That's basically right for passwords. Of course, if we impose password complexity requirements (e.g. must have a digit or an uppercase letter), it actually reduces the entropy in the password!