Here is a much simpler way to create easy to remember (not only somewhat easily remembered) and secure passwords: Use a complete sentence as your password! If it has more than four words, it is secure enough, and if you make it a bit obscure, nobody can guess it. So instead of
3Fin.wIt.my.Wom.'Ca.she.Cou.hEl.me.Wit.mY.min%
just use
Finished with your wife, although she helped my cat.

And BTW, forget about these special characters and such. The blanks that separate the words suffice. Special characters only make your password more complex and harder to remember. If you are concerned about the security, just choose a sentence that is a word longer.

Why? Because nothing beats length! (an increase in length adds to the exponent of the complexity, one more special character only adds to the mantissa).

In other words: Just make words the atoms of your "password" and you win twofold:
1. It easier to recall a (near)-sensible sentence than a single word (or the trace your cat left when it walked over your keyboard).
2. It is much more secure, because it is harder to crack (both by a dictionary attack and by simple brute force).

Here is the downside: It will take you longer to enter your password...

I use Password Maker ; it's way easier to remember a few settings than to remember hundreds of secure passwords, and i don't have to worry about someone finding my passwords stored anywhere (well, except in the databases of unsecure sites)

As I read all these password posts and don't happen to read any advice remotely near to the system I use, I only get more and more astonished. I just can't believe no one does this. Well, let me share what I do—may not be the best of the world but it works for me.

All* of my passwords are derived from the corresponding login and a couple of rules. Example:

• Take a reasonable string like vU4p!,a'fZx*
• Change its first character into the last in the login
• Change its fourth character into the second in the login
• Change its seventh character into the length of the login (or its last digit if the length is greater than 9)

So, if the login is "an0therlr3", the password would be 3U4n!,0'fZx*.

It takes a little of practice, but it pays off. The initial string could be based on a real sentence (as already suggested on this thread) for easy remembering. You can have more than one of these rules, of course. It's important not to change the last characters in the initial string, since some sites have an absurd limit of eg. 8 characters, and the modifications wouldn't be taken into account.

This even allows you to have the passwords written in a text file, stored unencrypted in the computer. Example:


A given attacker would have to break (by brute force) at least two passwords built with the same ruleset to be able to easily break a third.



* Excluding the typical bank PIN and the likes, which are severely crippled.

Not necessarily. Four obscure words joined together may be beyond the length of what many popular cracking tools support, and of relatively high strength. Assuming each word is only found in 100k+ dictionaries, there are 100000000000000000000 possibilities.

If such passwords are not strong enough, you really need to reconsider how much of your life should be tied to computers.

That's true, if a password is cracked, and a human examines it. But if your password is something like 15 characters, it will take centuries to crack, so it won't be your problem if anyone ever succeeds.

In early May of this year, LastPass announced that it believed that its user database had been compromised, very much like Mt. Gox recently.  Here's a link to a story in a respected technical news source, TechWorld:

http://www.techworld.com.au/article/385447/lastpass_hack_fear_leads_password_reset/

I work as a technical writer for a Fortune 1000 firm in the U.S., in a product area that provides security software for use by banks and other institutions that deal with financial and other highly sensitive (usually legally protected) information.  I would NEVER use or recommend a cloud-based product to protect passwords to any account that is linked with a bank account that I own or a credit card that I am responsible for.  LastPass is a great idea for managing all of those accounts you have to sign up for to get access to news sites or other fun stuff, but not for the accounts that actually matter.  

For accounts that matter (your bank accounts, accounts on your credit card site, PayPal, Dwolla, investment firm accounts, accounts with a currency or stock exchange, accounts with your utility company, etc.), you need something local and secure.  I recommend keeping those passwords stored in a text file encrypted with GPG or in some other form that uses a strong encryption method.  I also recommend backing the encrypted file up on a USB dongle or (even better) a CD that you replace every time you add a password.  Finally, use a product that wipes (rather than just deleting) files on the computer that you use to encrypt and decrypt this file, and wipe the swap file every time you access that file.  Another option is to use a product that encrypts your hard disk or swap file, or both, such as TrueCrypt or my favorite, Jetico Bestcrypt.

I'm not entirely immune to hackers or a password-stealing trojan; nobody is.  But if you do what I suggested, your chances of surviving a hacker or virus intent on stealing valuable information are much improved.