Is that right?
Is that right?
3f38ba8a6ce3aa800f007c2e431df7fd 124 bits
9339bf587ee11b12d207df846a879cf4 129 bits
8ca4354a9038df590fecec1f964062fd 121 bitsI randomly generated an 8 character alphabetical (all lower case) password "jraxxhwr". According to keepass it has 32 bits of entropy, but the entropy should be 26^8 = 37.6 bits because the search space is all 8 character letter permutations. There's no way you can reduce the search space from 37.6 bits to 32 bits unless you have an oracle that says which characters I used.
In theory, "68703649" and "12345678" are equally likely to be pulled from the hat, but in practice one is a much better password than the other. You can reduce the search space by trying the passwords with higher (empirical) probability first.
KeePass sources are available [0], you can see the specific algorithms it uses in [1].
[0]: https://sourceforge.net/projects/keepass/files/KeePass%202.x...
[1]: https://fossies.org/windows/misc/KeePass-2.42.1-Source.zip/K...
Then the discrepancy maybe comes from the number of glyphs within certain categories, or their repetition?