The only way to guarantee the entropy of a passphrase is to generate it from a source of high quality randomness (e.g. a CSPRNG or by actually rolling dice, hence the name "Diceware"). Diceware-style passphrases simply balance this requirement with usability by optimizing for things humans are typically good at memorizing (strings of words).
Relevant Dilbert:
My thinking was that "Correct Horse Battery Staple" had more entropy than: "go go go go go go go go go go go go go"
.. which, apparently, is not
A password from the space of "things users think up while staring at a dialog box for 5 seconds" has a much different probability distribution than "random strings". There are common passwords, and that's an exploitable pattern, but recognizing those patterns is difficult. All the typical entropy checker is going to tell you is how strong the password would be if it were a random string.
Any pattern is, in principle, exploitable. If I use ten digits of pi as a password, a programmed entropy checker isn't going to know that's easier to guess than ten random digits unless it has been told that, and including all possible exploitable patterns would require rather better software than can currently be written.
So don't trust the results too much.
What you really want to know with passwords is, "Is there outside information that would make this easy to guess?" Does it conform to some external, independent pattern, or are all the patterns in it things you made up after seeing the password itself?
That is why I am a big advocate of random generation as the only safe way to make passwords. Knowing the strength of a password is the same thing as knowing the size of the class of live probabilities from which it's drawn, and to do that you have to characterize the method used for generating it.
If your sample space is "all words in the english language, capitalized and uncapitalized", then the second one has more entropy than the first one. But if your sample space is "all characters or runs of characters that appear in the passphrase", the second one has a whole lot less entropy.
Well assuming random guessing with 95% vocabulary coverage its about 50,000 words. A passphrase checker that doesn't start from there but rather works from the ascii tokens is likely not very helpful for checking the strength of a passphrase.
> ... should be 8 characters or longer, which forces you to use multiple words or extra symbols. > ... should have upper case, lower case, symbols, and numbers; or at least three of those four groups. > ... should not be a common word and should not be a common phrase. > ... should not contain a date, a name, or other things that can be associated with you. > ... should be created randomly or semi-randomly. > ... should not be a suggestion when you type in the first few characters into Google.
As for your cited tester, you seem to have ignored every single piece of advice on the page and it seems it doesn't test for it in an automated way. I'd say, in this case, the problem is a bug in the tester rather than the truth of that being "safe".
If you had followed the guidelines, yes, it'd likely be reasonably safe.
1. http://rumkin.com/tools/password/passchk.php