Related: http://xkcd.com/936/ http://xkcd.com/936/ There's only one downside. If you generate your password based on a phrase and add the service name to that,

Related: http://xkcd.com/936/ http://xkcd.com/936/ There's only one downside. If you generate your password based on a phrase and add the service name to that, it could be easily guessed in other services. If you use RedBananasFlyReallyHighAmazon for Amazon and RedBananasFlyReallyHighPayPal for PayPal (which, by the way, doesn't work, as PayPal for whatever reason blocks the word PayPal), one could guess the password from the other service, if one gets compromised. Ultimately, you can only hope for the service to store the password hashed and salted, but in reality, that is not always the case or there's some novice programmer trying something out and all passwords are logged in plaintext somewhere else, while the database stores them hashed and salted. But generally, I prefer this approach, as it provides a lengthy password, different for every service and easy to remember.