Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Here is a cartoon about password entropy. http://xkcd.com/936/
I dont quite understand how the entropy is calculated in the cartoon assuming they are calculate correctly. But in general, I dont have much idea about how password entropy is calculated.
First of all: Entropy is a property of the process generating a password, not a property of an individual password.
Apart from that, the basic idea is the following: Say you have the password aeLuboo0 that contains lower-case chars, upper-case chars and numbers. Then under the assumption that you have choosen every character uniformely from all possible characters, there are in total
$$(26 + 26 + 10)^8 = 218340105584896$$
many passwords that can be generated in the same way as your concrete password has been generated. The entropy in bits is now the number of bits you need to have approximately the same number of possible bit-combinations. That is:
$$\log_2((26 + 26 +10)^8) = 47.633570483095$$
Hence the assumed process that generated your password aeLuboo0 can generated as many different equal likely passwords, as different numbers can be represented by $47.63$ bits. The entropy of the password can be assumed to be at $48$ bits.
The cartoon has the example of a word, that has been taken from a dictionary and then mutated to get the actual password. The idea of entropy is the same again (heavily simplified): Guess the number of different words your theoretical source dictionary and multiply it by the number of possible mutations the get a total count of passwords that can be generated in this way. Now find the $\log_2$ of this count to approximate the entropy.
