An online entropy checker is going to assume all the decisions that went into making the password, beyond the ones it's been programmed to understand, were die

An online entropy checker is going to assume all the decisions that went into making the password, beyond the ones it's been programmed to understand, were die rolls. This is a false assumption unless, of course, those decisions actually were die rolls. It's generally going to tell you passwords are stronger than they are -- sometimes a LOT stronger. A password from the space of "things users think up while staring at a dialog box for 5 seconds" has a much different probability distribution than "random strings". There are common passwords, and that's an exploitable pattern, but recognizing those patterns is difficult. All the typical entropy checker is going to tell you is how strong the password would be if it were a random string. Any pattern is, in principle, exploitable. If I use ten digits of pi as a password, a programmed entropy checker isn't going to know that's easier to guess than ten random digits unless it has been told that, and including all possible exploitable patterns would require rather better software than can currently be written. So don't trust the results too much. What you really want to know with passwords is, "Is there outside information that would make this easy to guess?" Does it conform to some external, independent pattern, or are all the patterns in it things you made up after seeing the password itself? That is why I am a big advocate of random generation as the only safe way to make passwords. Knowing the strength of a password is the same thing as knowing the size of the class of live probabilities from which it's drawn, and to do that you have to characterize the method used for generating it.