If you need to memorize a password, I still stand by the Schneier scheme from 2008:

So if you want your password to be hard to guess, you should choose something that this process will miss. My advice is to take a sentence and turn it into a password. Something like “This little piggy went to market” might become “tlpWENT2m”. That nine-character password won’t be in anyone’s dictionary. Of course, don’t use this one, because I’ve written about it. Choose your own sentence — something personal.

Until this very moment, these passwords were still secure:

WIw7,mstmsritt… = When I was seven, my sister threw my stuffed rabbit in the toilet.

Wow…doestcst::amazon.cccooommm = Wow, does that couch smell terrible.

Ltime@go-inag~faaa! = Long time ago in a galaxy not far away at all.

uTVM,TPw55:utvm,tpwstillsecure = Until this very moment, these passwords were still secure.

You get the idea. Combine a personally memorable sentence, some personal memory tricks to modify that sentence into a password, and create a long-length password.

Better, though, is to use random unmemorable alphanumeric passwords (with symbols, if the site will allow them), and a password manager like Password Safe to store them. (If anyone wants to port it to the Mac, iPhone, iPad, or Android, please contact me.) Ars Technica does a good job of explaining the same thing. David Pogue likes Dashlane, but doesn’t know if it’s secure.