From the Security FAQ:

 >Q.16 How can I generate safe passwords?
 >
 >You can't.  The key word here is GENERATE.  Once an algorithm for
 >creating passwords is specified using upon some systematic method, it
 >merely becomes a matter of analysing your algorithm in order to find
 >every password on your system.
 >
 >Unless the algorithm is very subtle, it will probably suffer from a
 >very low period (ie: it will soon start to repeat itself) so that
 >either:
 >
 >  a) a cracker can try out every possible output of the password
 >  generator on every user of the system, or
 >
 >  b) the cracker can analyse the output of the password program,
 >  determine the algorithm being used, and apply the algorithm to other
 >  users to determine their passwords.
 >
 >A beautiful example of this (where it was disastrously assumed that a
 >random number generator could generate an infinite number of random
 >passwords) is detailed in [Morris & Thompson].
 >
 >The only way to get a reasonable amount of variety in your passwords
 >(I'm afraid) is to make them up.  Work out some flexible method of your
 >own which is NOT based upon:
 >
 >  1) modifying any part of your name or name+initials
 >  2) modifying a dictionary word
 >  3) acronyms
 >  4) any systematic, well-adhered-to algorithm whatsoever
 >
 >For instance, NEVER use passwords like:
 >
 >alec7 		- it's based on the users name (& it's too short anyway)
 >tteffum		- based on the users name again
 >gillian		- girlfiends name (in a dictionary)
 >naillig		- ditto, backwards
 >PORSCHE911 	- it's in a dictionary
 >12345678 	- it's in a dictionary (& people can watch you type it easily)
 >qwertyui 	- ...ditto...
 >abcxyz		- ...ditto...
 >0ooooooo	- ...ditto...
 >Computer 	- just because it's capitalised doesn't make it safe
 >wombat6 	- ditto for appending some random character
 >6wombat 	- ditto for prepending some random character
 >merde3		- even for french words...
 >mr.spock 	- it's in a sci-fi dictionary
 >zeolite 	- it's in a geological dictionary
 >ze0lite 	- corrupted version of a word in a geological dictionary
 >ze0l1te 	- ...ditto...
 >Z30L1T3 	- ...ditto...
 >
 >I hope that these examples emphasise that ANY password derived from ANY
 >dictionary word (or personal information), modified in ANY way,
 >constitutes a potentially guessable password.
 >
 >For more detailed information in the same vein, you should read the
 >APPENDIX files which accompany Crack [Muffett].
 >
 >Q.17 Why are passwords so important?
 >
 >Because they are the first line of defence against interactive attacks
 >on your system.  It can be stated simply: if a cracker cannot interact
 >with your system(s), and he has no access to read or write the
 >information contained in the password file, then he has almost no
 >avenues of attack left open to break your system.
 >
 >This is also why, if a cracker can at least read your password file (and
 >if you are on a vanilla modern Unix, you should assume this) it is so
 >important that he is not able to break any of the passwords contained
 >therein.  If he can, then it is also fair to assume that he can (a) log
 >on to your system and can then (b) break into "root" via an operating
 >system hole.
 >
 >Q.18 How many possible passwords are there?
 >
 >Most people ask this at one time or another, worried that programs
 >like Crack will eventually grow in power until they can do a
 >completely exhaustive search of all possible passwords, to break into
 >a specific users' account - usually root.
 >
 >If (to simplify the maths) we make the assumptions that:
 >
 >  1) Valid passwords are created from a set of 62 chars [A-Za-z0-9]
 >  2) Valid passwords are to be between 5 and 8 chars long
 >
 >Then the size of the set of all valid passwords is: (in base 62)
 >
 >				   100000 +
 >				  1000000 +
 >				 10000000 +
 >				100000000 =
 >				---------
 >				111100000	(base 62)
 >
 >A figure which is far too large to usefully undertake an exhaustive
 >search with current technologies.  Don't forget, however, that
 >passwords CAN be made up with even more characters then this; you can
 >use <space>, all the punctuation characters, and symbols (~<>|\#$%^&*)
 >too.  If you can use some of all the 95 non-control characters in
 >passwords, this increases the search space for a cracker to cover even
 >further.
 >
 >However, it's still MUCH more efficient for a cracker to get a copy of
 >"Crack", break into ANY account on the system (you only need one), log
 >onto the machine, and spoof his way up to root priviledges via
 >operating systems holes.
 >
 >Take comfort from these figures.  If you can slam the door in the face
 >of a potential crackers with a robust password file, you have sealed
 >most of the major avenues of attack immediately.
 >