Entropy
A measure of unpredictability in bits — how many guesses an attacker needs on average.
A password with 40 bits of entropy takes on the order of 2⁴⁰ attempts. The key point is that entropy measures the randomness of the source, not how the string looks: Tr0ub4dor&3 looks random but has low entropy because it follows a predictable pattern.
The operating system harvests entropy from interrupt timings, disk activity and hardware generators such as RDRAND, and feeds a CSPRNG. Freshly booted virtual machines and embedded devices are risky precisely because they start with an empty pool.