How the score works
The score runs from 0 (guessed almost instantly) to 4 (safe even against fast offline attacks). zxcvbn splits the password into the cheapest combination of known patterns, estimates how many guesses an attacker needs to reach each one, and multiplies them together. A long password built from one common word and a year can score worse than a short truly random one, which is exactly how real cracking tools behave.
The guess count feeds four crack-time estimates. Online attacks go through a login form, at roughly 100 guesses per hour when the site throttles attempts and 10 per second when it does not. Offline attacks assume the attacker stole the password database, at about 10,000 guesses per second against a slow hash like bcrypt and 10 billion per second against a fast hash on GPUs. The honest answer to "is my password safe" is the offline fast hash number, because you never know how a site stores it.
What the matched patterns mean
Attackers do not brute force from "aaaa" upwards. They try leaked passwords, dictionary words, names, dates, keyboard walks like qwerty and simple sequences first, including reversed spellings and substitutions like p@ssw0rd. Every such pattern in your password collapses a huge search space into a few thousand guesses. The parts marked as having no pattern are the ones doing real work.
To create a password that scores well, generate a random one or a diceware passphrase with the Password Generator.