See XKCD 936—Password Strength.