And which user actively uses more than a couple of thousand words in something like a password? I'd expect actual entropy to be way less.