41.36/8 = 5.170; consulting “Entropy per symbol for different symbol sets” table on the wikipedia password strength page, I see that’s the value for “Case insensitive alphanumeric”, which is almost certainly not what Discourse is using. I believe 52.56 bits is the correct value for how Discourse treats passwords, and 65.7 is the minimum acceptable amount with a 10 “character” password. That table does not address UTF-8.