That would be true if the password were 16 random ascii characters. But of course it's not. It's almost certainly only using printable characters, and probably has something a lot like words in it.

Just to chip another little piece off, ascii is a 7-bit encoding, and the 8th bit is clear, so that makes 16 × 7 = 112 bits if we use any ascii byte (0..=128).

I'd count 6 bits per letter (64 different characters) as a rough estimate for realistic passwords.

English text has 1.46 bits of entropy per character.

https://www.gwern.net/docs/statistics/1996-teahan.pdf

You wouldn't use english text for the password, for this reason.

That’s why I, in the EDIT, then chose to assume 2^5 different characters, which is roughly lowercase ascii plus some special characters.

That’d still be 80 bits, and still secure enough.

An 80 bit password would be secure. In fact, now that I am aware of this issue I generate the master password for Thunderbird with PfP: Pain-free Passwords and it's in fact around 80 bits strong (too bad that I cannot use PfP in Thunderbird directly). But if you as a human choose a 16 characters password you will get far less than 80 bits. Passwords chosen by humans follow known patterns, use dictionary words etc. Which is why password cracking applications won't stupidly test the entire password space - they will go for passwords that humans are more likely to choose. Fact is, for a human getting significantly higher than 40 bits while still being able to remember the password is very hard.

maybe i am wrong, but i think you did not read the full article?

"This article estimates that the average password is merely 40 bits strong, and that estimate is already higher than some of the others. In order to guess a 40 bit password you will need to test 2^39 guesses on average. If you do the math, cracking a password will take merely a minute on average then. Sure, you could choose a stronger password. But finding a considerably stronger password that you can still remember will be awfully hard."

I did, but that assumes the average person. This is HN, not Facebook, so we can make different assumptions.

E.g., we can assume that everyone has read the famous XKCD on passwords, and is using passwords that are a bunch of words after another, in lowercase ascii, which would get us somewhere around 80 bits of security, and still keep it memorable.

That xkcd comic recommends a password that by its own estimate is 44 bits of entropy. Why do you assume a HN user would choose something stronger than that?