An 80 bit password would be secure. In fact, now that I am aware of this issue I generate the master password for Thunderbird with PfP: Pain-free Passwords and

An 80 bit password would be secure. In fact, now that I am aware of this issue I generate the master password for Thunderbird with PfP: Pain-free Passwords and it's in fact around 80 bits strong (too bad that I cannot use PfP in Thunderbird directly). But if you as a human choose a 16 characters password you will get far less than 80 bits. Passwords chosen by humans follow known patterns, use dictionary words etc. Which is why password cracking applications won't stupidly test the entire password space - they will go for passwords that humans are more likely to choose. Fact is, for a human getting significantly higher than 40 bits while still being able to remember the password is very hard.