Don't use common words (anything in any dictionary) as hackers use a dictionary attack as first port of call often (depending on what they might already know about their target) Running through dictionary combos first is quicker than brute-force AFAIK. I tell my clients: If you have to use a phrase or combo of words/names then put a delimiter in between eg theQuickbrown can become: the$quick$brown or maybe: thequickbr@wn or tHeQuIcKbRoWn, anyways, u get the idea.. Not that passwords do much to stop hackers in this day and age, having a password you can remember is more important than one that can withstand brute-forcing