Calculating entropy within xkcd 936: Password Strength When I calculate entropy for the xkcd Password Strength (comic 936) I don't get nearly the amount of entropy stated in the comic.

So why doesn't the the first password "Tr0ub4dor&amp;3" have an entropy of around 50 bits? And why doesn't the passphrase sentence "correcthorsebatterystaple" represent over 100 bits of entropy?
I don't get nearly the amount of entropy stated in the comic.


Interestingly enough the reasoning for the entropy rating are actually justified in the comic by the little boxes which each represent 1 bit of uncertainty.

This means for Tr0ub4dor&amp;3


It's estimatated that the word itself "Troubador" comes up in dictionaries which contain about $2^{16}$ words
It adds one bit for each of o,a,o of the word to encode whether the letter was replaced or not
It adds one bit to decide whether the word was capitalized or not
It adds one bit for the ordering of the trailing numeral and special character
It adds 3 bits for the unknown numeral, approximating $10$ with $2^3$ instead of $2^4$ which is more accurate
It adds 4 bits for the unknown punctuation, ie which of the approximately 16 standard ones it is


This sums up to $16+3+1+1+3+4=28$

For correct horse battery staple the reasoning is that each of the four words is drawn from a dictionary of size $2^{11}$ which means $4\times 11=44$ bits of entropy.

In both cases it can be assumed that the attacker knows the possible choices influencing the entropy estimation and that it's actually a uniformly random decision which word / pick is done.



If you want an even more thorough explanation of this comic, I can only recommend you read the bear's answer on this over on InfoSec.SE.