Comment by pama

That’s a great reminder that what humans consider random and what is a truly random sets of states with high entropy are typically different things. In this case out of 43 quintillion combinations, there’s only 48 that fit the human imposed random criteria. In the case of passwords, websites typically ask for lots of additional constraints in what a password must have leading to dramatic reductions in the brute force effort required to find a password.