How secure is a pronounceable password in terms of entropy? There are some strong studies which support the use of pronounceable passwords and multiple tools which provide generation of such passwords.

According to this question the entropy of a password depends on its method of generation but how can I be sure that my generated pronounceable password has enough entropy for my use? (for example, in case of pwgen open source software)

Below is a pseudocode for generating a pronounceable password. However, this might be the simplest possible solution and I am rather interested in existing "conventional" methods.

vowels = A, AI, AU, E, EA, EE, I, IA, IO, O, OA, OI, OO, OU, U
consonants = B, C, CH, CL, D, F, FF, G, GH, GL, J, K, L, LL, M, MN, N, P, PH, PS, R, RH, S, SC, SH, SK, ST, T, TH, V, W, X, Y, Z
theLastOneIsAVowel = True
while length(strPassword) &lt; Minimum_Length do
if theLastOneIsAVowel then
strPassword = strPassword + randomElementOf(consonants)
else
strPassword = strPassword + randomElementOf(vowels)
endif
theLastOneIsAVowel = ~(theLastOneIsAVowel)
endwhile
Yes, the entropy depends on the generation process. The study you link to has the answer for the (fixed) process used there:


  To overcome this [flaw in the original program], we generated the full list of eight-character pronounceable passwords without duplicates (≈ 1.2 billion) and assigned each password on this list with equal probability, resulting in 30.2 bits of entropy.


That is equivalent to five base 64 characters. I.e. you lose about 2.25 bits of entropy per character by making the password pronounceable, compared to using random base 64 passwords.

However, like the implementation they used, it is possible the algorithm is flawed and does not generate all possible pronounceable passwords with equal probability. In that case you lose even more entropy. So I would check the program carefully before relying on it.