No, he measures the entropy based on a machine knowing the format.<p>If I roll a dice, and ask you to guess the result, it will take you 3 guesses on average to get the result.  If I ask you to guess the random word I&#x27;ve chosen, it will take you around 1000 guesses (if I have a small vocabulary).<p>Entropy is calculated as ln₂(x), where x is the number of possibilities. With four common words from a list of 2000:<p><pre><code>    4 × ln₂(2000) ~= 44
</code></pre>
as used in the comic.<p>If, instead, the password was taken to be 28 random characters from [a-z ], the entropy would be<p><pre><code>    28 × ln₂(27) ~= 133
</code></pre>
This is the overestimate that the artist didn&#x27;t make.<p>With a genuinely random alphanumeric password, like 0LsW-nT5#^kQ, the entropy is higher:<p><pre><code>    12 × ln₂(92 keys on the keyboard) ~= 78.
</code></pre>
but the point of the XKCD was to show a memorable password.