Because you cannot accurately measure entropy based on a single password. A proper estimate of entropy is based on examining the app that generated the password. Since the workflow is limited to inspecting the drain bamaged suggestions that users are suggesting for a password, we are left in a difficult position. These “entropy calculators” that examine a single password are snake oil, but too many users try to use their sad little brains instead of a PRNG and a reputable password/passphrase app. More on reddit.com

The dice is not the roll. You are literally telling these calculators "I rolled a 17" and asking them "How many sides does my die have?". It could be 20. It could be 100. It could be just a coin with 17 painted on one side and 5 painted on the other. Entropy is a measure of the dice. Entropy is a well-defined, mathematical concept that applies to probability distributions, not outcomes. Not. Outcomes. If you observe an outcome and were forced to estimate the entropy of the distribution, this gets into astrology territory. There are reasonable, well-meaning heuristics for doing so, but all of it is arbitrary on how the authors wants to define it. Depending on how your calculator wants to weigh certain features, you get different answers. This is because, as stated above, entropy calculators only see the roll, and therefore are always just a "guess". You can build different ways of guessing, that's why you get different results. Authors of these calculators don't always understand entropy themselves and it causes a spread of false understanding of entropy. Don't fall for it. More on reddit.com

The other explanations here are true but maybe this will clarify why. Bad password checkers assume a cracking program will guess, in order: a, b, c, … aa, ab, ac, ad, … and so on forever. Good password strength checkers calculate entropy (~randomness) with the assumption of common reasonable wordlists and standard variations on those words, in addition to gibberish character strings. Password cracking tools don’t tend to guess every single random string of characters from shortest to longest, since many people are more likely to choose real words or variations of words. So, for example, “eggplan” is actually a stronger password than “eggplant” despite having fewer characters. They’re both awful, but any decent password cracking tool will guess a word a human is more likely to choose first (vs egg + plan, two unusual words to combine). “eggplan” will even take longer to crack than “eggpl@nt” because a→@ is such a common substitution for humans trying to strengthen their passwords that password cracking tools will likely try it first. Extending to longer sequences, 3-6 memorable unmodified words chosen randomly from very long lists will usually be both more memorable and harder to crack than 2-3 words with symbols inserted. Edit to add: the best way to get a sense of how this works in practice is here: https://lowe.github.io/tryzxcvbn/ More on reddit.com

They are clearly making some different assumptions. By raw brute force this would take a while. But these are two dictionary words with common letter to number substitutions and no special characters. A wordlist plus mutations (o->0, l->1, etc) would make this a lot faster than raw brute force. I personally feel that Aband0nedFairgr0und is about as secure as AbandonedFairground which is easily taken care of by running a dictionary attack with two words against this. The first link seems to only use brute force estimation because it doesn't flag your result lower when you use a word like password instead of random letters like akdudlqu. More on reddit.com