Entropy is the only measure of password strength that means anything: how many guesses it takes. Complexity rules — one capital, one digit, one symbol — measure almost nothing, and they push people towards Password1!, which is the first thing anyone tries. Adding a character multiplies the work; adding a character class only widens the alphabet a little, which is why twenty lowercase letters beat twelve characters of mixed punctuation.
Also what a bit of entropy means in practice, how many random words make a secure passphrase and why five is usually enough, why the arithmetic only holds if a machine did the choosing, and why reuse rather than length is what actually loses accounts.