3 ms·

That was my point, you don't really know the character set used, you only know the characters used. It is reasonable to assume that the characters of »cat« were

That was my point, you don't really know the character set used, you only know the characters used. It is reasonable to assume that the characters of »cat« were drawn from the set of lowercase letters but for all you know they could have been drawn from a set of three letters and to err on the side of caution you probably should assume it was indeed drawn from the set of three letters. And of course, password crackers can do a lot more than simply brute force through all possible character sequences, which just underlines my point that calculating the entropy or maybe better the resistance against password crackers is non-trivial. But as others have pointed out, there are are existing implementations like zxcvbn and you do not have to solve this problem from scratch.

Tostino 4y ago
Yup, I understand the problem space. I wrote one of the ports for zxcvbn and have been maintaining it for the past ~7 years. You are absolutely right there, and zxcvbn makes a guess by using the whole character set for a specific type. It groups a whole bunch of special characters together as well, potentially overestimating passwords that contain a special chars. This is mitigated by the fact that it's much less important to be good at estimating the score of a properly random password than it is at estimating poorly (human) constructed password. It's a game of making the best assumptions you can, but total accuracy is not something to shoot for here.