title: Help with the calculation (and usefulness) of password entropy
body: <p>This is a two part question:</p>
  
  <p><strong>Part 1</strong></p>
  
  <p>First, dealing with calculating the entropy of a password in PHP.  I have been unable to find any code examples that are empirically sound and would really like some help in finding the 'right' way to calculate a final number.  A lot of folks on the net have their own home-baked weighting algorithm, but I am really looking for the scientific answer to the equation.  </p>
  
  <p>I will be using the password entropy as just one part of a larger security system and as a way to analyze our overall data security based on information accessible if a user's password is compromised and how easily a password may be broken by brute force.</p>
  
  <p><strong>Part 2</strong></p>
  
  <p>The second part of this question is: how useful will this number really be?  My end goal is to generate a 'score' for each password in the system that we can use to monitor our overall system security as a dynamic entity.  I will probably have to work in another algorithm or two for dictionary attacks, l33t replacement passwords, etc--but I do feel that entropy will play an important role in such an 'overall' system rating.  I do welcome suggestions for other approaches though.</p>
  
  <p><strong>What I Know</strong></p>
  
  <p>I have seen some mention of logarithmic equations to calculate said entropy, but I have yet to see a good example that isn't actually written as a mathematical equation.  I could really use a code example (even if not strictly in PHP) to get me going.</p>
  
  <p><strong>Extension</strong></p>
  
  <p>In making a comment I realized that I can better explain the usefulness of this calculation.  When I am working on legacy systems where users have extremely weak passwords I have to have some concrete evidence of that weakness before I can make a case for forcing all users to change their passwords to a new (enforced) strong password.  By storing a password strength score for each user account in the system I can build several different metrics to show overall system weakness and make a case for stronger passwords.</p>
  
  <p>TIA</p>