(I've left this as an answer, rather than a wiki, to encourage multiple answers since there may be other explanations that resonate better with people)
For brevity, this answer assumes that the underlying cryptography of Ethereum has not been broken.
private key = only way to access an Ethereum account
password = protects private key via encryption; ...
Entropy implies randomness.
Using deterministic algorithms on a password is not entropy and SHOULD NOT be used!
I would recommend researching how to gather entropic data from whatever programming language you're using.
The mnemonic key phrase? How is that generated?
I'm not sure how MetaMask generates it. But I can guess that it uses a similar approach to the other standards our there. E.g. BIP 39
For a detailed "how is this done".
You need random data, aka, entropy.
You get enough of that and do fancy computes on said data.
That data is then ...