@benjacobsen @PerryM It seems like this is especially true of the use of non-alphanumeric symbols in passwords. Most people insert them through some semi-formulaic procedure (like using l33t speak), so I really doubt it adds that much entropy in practice.