Having a random length makes very little total difference in the entropy of your password compared to the entropy you would get using just the maximum length allowed. This is because there are a lot more passwords of, say, length 10 than any shorter length (in fact, there are more 10-character passwords than any other shorter password). So if your attacker has the ability to brute force 10-character passwords, he can easily brute-force passwords from 1 to 10 characters with more or less the same amount of work.
In fact, many password cracking programs take advantage of this by going through the shorter passwords first, as checking them takes a negligible amount of time compared to checking all the longer ones, so if you chose a 9-character password in an effort to thwart your opponent, your password will probably take a fraction of the time a 10-character password would have taken. In other words, choosing a random length is a very bad move, always choose the longest possible length (up to some limit dictated by the software you use or your ability to manage that password).
To justify why they do this, let's get some numbers. For instance, assume a charset of 96 symbols (typical ASCII + special characters stuff). How many 10-character passwords are there?
Answer: $96^{10} \approx 6.64 \times 10^{19}$
Now how many passwords of length shorter than 10 are there:
Answer: $\sum_{k = 1}^9 96^k \approx 7 \times 10^{17}$
And so:
$$\frac{\text{Number of passwords length less than 10}}{\text{Number of 10-character passwords}} = \frac{7 \times 10^{17}}{6.64 \times 10^{19}} \approx 0.01$$
What does this mean? It means that if someone took, say, one year to search through all 10-character passwords, it would only take him about 4 days to search through all passwords of length 1 to 9. Clearly, that person might as well search them too if he isn't sure of the length, for very little additional cost. And he may as well do them first to spare himself a year of waiting in case you picked one of the shorter passwords.
You can do the math for other lengths and charsets, and you'll see that in general, it's not worth it.
To conclude, if an opponent has the ability to brute force passwords of length $l$, then picking a random password of length between $k$ and $l$ where $k < l$ offers very little additional protection, and may in fact decrease security as shorter passwords are generally searched first.
