I agree with you, but that's not how Randall got the entropy for the comic. His entropy numbers come from NIST SP 800-63[0], for "correct horse battery staple"

I agree with you, but that's not how Randall got the entropy for the comic. His entropy numbers come from NIST SP 800-63[0], for "correct horse battery staple" spaces included. But NIST SP 800-63 has been shown to be invalid in metric for entropy, making the comic's numbers incorrect in real application.[1] [0]: http://en.wikipedia.org/wiki/Password_strength#NIST_Special_Publication_800-63 http://en.wikipedia.org/wiki/Password_strength#NIST_Special_... [1]: http://reusablesec.blogspot.com/2010/10/new-paper-on-password-security-metrics.html http://reusablesec.blogspot.com/2010/10/new-paper-on-passwor...