Strength is estimated from length × character variety. Common or leaked passwords are still weak even at high entropy.