You need a password generation process which could produce a bazillion different passwords, with uniform probability, so that the attacker cannot guess which one you actually obtained; then, the best the attacker can do is to try them all (in any order), which will succeed after an average of a half-bazillion tries.