I've come to the conclusion that the most important thing by far is a different password for every site. If you do nothing else, figure out a way to do that. It

I've come to the conclusion that the most important thing by far is a different password for every site. If you do nothing else, figure out a way to do that. It's probably also a good idea to make sure that your security question answers are anything but the actual answers to those questions. I prefer looking up random words for each one, and storing them in the Lastpass entry for the site. I view password complexity and obsessing over how hard it would be to crack your password hash with various setups to be of little value. If they're far enough in to get your password hash, it's better to assume they can see and do anything and everything on the site even if they can't crack your password. If you've actually used a different password on every site, there isn't much left to worry about. Still, if you're using a password manager, it's cheap to make all of your passwords long, random strings with upper, lower, numbers, and specials, so why not do it?