I generally use GnuPG for encrypting my files and as far as I know its strength ultimately depends on the passphrase I use. So, I would like to know: how can I mathematically calculate how secure my password is? How do I know whether my password is safe or not?
For security reasons, don't enter your real password, but an approximation, for example, if your password is asl6234FDS, type ajk0175MAF. Strong password has a score of 100%.
The usual mathematically calculated metric is the entropy. You find this by taking the log base 2 of the number of possible passwords that would have to be tried in order to be sure of getting yours.
So, if you have a three character password of lower case letters, there are 729 possible passwords (3^26) and the entropy is around 9.5.
Some important things to note:
The strength of a password is, exactly, a measure of what it could have been. The technical term for cryptographers is "entropy". The rough idea is the following: there is a set of "possible passwords" -- the passwords that you could choose. The attacker will try the passwords from that set. The attacker will be defeated if the set is large enough, because the larger the set, the longer it will take the attacker to hit the right password (on average).
For instance, if your passwords are sequence of 9 decimal digits, then the set of possible passwords has size, exactly, one billion (109). If you choose your password at random in that set, then, on average, the attacker will have to try half of the set before trying yours, so 500 millions.
Thinking about a big bag of possible passwords from which you choose, at random and uniformly, works as long as you really pick the password at random and uniformly. That's easy to do with a computer, very hard with a brain: the jelly which you keep inside your skull is remarkably good at a lot of tasks (such as image recognition), but not at randomness.
The important point to understand is that password strength comes from the password generation process. A given password is not strong "by itself". That's where "password meters" totally fail. A "password meter" sees only the password you type, not how you chose it. If you prefer, a password meter site will tell you how much time it would take an attacker to guess the password, assuming the site is the attacker, and knows nothing else about you. That's not completely realistic: your enemy knows you, much better than a lambda site on the Web. He is after you, specifically, and he must be assumed to be smart.
So, to estimate your password strength:
Hence the rules for strong passwords:
In the famous XKCD password comic, the author suggests taking a list of 2048 "common words", and then selecting four such words (at random, with dice): the four words, concatenated, will be the password. The set of possible passwords then has size 20484 = 17592186044416, which is quite good. The point of the author is that such passwords are easy to remember (whatever the four words you obtain, you will find a corresponding "story"). Personally, I prefer shorter passwords which are just random letters (my brain, being that of a mammal, is bad at randomness, but it is quite good at remembering strings of symbols).
The key to remembering a password is to type it daily.