The short XKCD password is based on a dictionary word, making it vulnerable to intelligent brute force (oxymoron of the day).

I imagine the calculation goes something like this:

  1/50000     Likelihood of a particular uncommon word
  1/8         Substitute up to three letters for numbers
  1/2         Initial capital or initial lowercase
  1/32        Add a punctuation character at the end
  1/10        Add a digit at the end
  1/2         Possibly swap punctuation and digit at the end
  ----------------------------------------------------------
  1/512000000 Resulting probability
  -28.93157   log2(1/512000000) -- number of bits of entropy

So, if e.g. XKCD assumed only 25000 uncommon words to choose from, that would give ~28 bits of entropy.

Thanks for the thorough answer! I originally missed the part about using a real word as the base.

For my passwords, I use 8 character random strings so hopefully I am a little safer. Although, as I'm learning from all of these password leak debacles, you are only as secure as the systems using those passwords.