Generally speaking, my advice is simply don’t use passwords at all. Use other methods that allow you to avoid them. Any password that is chosen and easy enough

Generally speaking, my advice is simply don’t use passwords at all. Use other methods that allow you to avoid them. Any password that is chosen and easy enough to remember by a human being is one that is weak enough to be easily cracked, perhaps by well-known methods, or perhaps by more recent ones. Let computers do what they do reasonably well, and don’t try to make humans do that job. Specifically, one key is to use hardware tokens that have been tested and proven to be reasonably robust. You have to tie them into your authentication system, but hopefully that’s not too hard. What about biometrics? Well, don’t use biometrics as a password, because your finger or your eyeball can get taken from you, and you wouldn’t like the after effects. More importantly, if the biometrics for your finger or eyeball become compromised, then how do you change them? All of my fingerprints were compromised in the OPM data breach, because I worked for the DoD, and OPM was where all that information was stored. I’m sure there have been other major breaches of biometric data. Biometrics, if you’re going to use them at all, are best used as the equivalent of a username. They identify who you claim to be, but they explicitly do not authenticate you. You may have my fingerprints, but my username is already pretty well known, and so having my fingerprints would be unlikely to help you there. What else? After all that, if you still have to use passwords, then try to use them as the final layer of security on top of all of the above. Don’t be dependent on them for your only security. And where possible, use a good password manager program to remember and generate all of them for you, so that you minimize the human weakness of that part of the chain.