The idea that 'password' or '123456' are bunkum stats, and\or that is completely irrelevant anyway; most of their users would have deliberately selected a quick, easy passcode with zero interest in the security value of it -- I do not want to need any more passcodes than necessary; if someone uses my avatar \ username on Reddit or 4chan I could not care less, so I use nothing, or as close to nothing as possible, for a passcode.The overwhelming majority of websites and corporate networks require far more security that that, and you would rarely if ever be able to use a single-cased dictionary word or six numbers, as your password. Even blogging sites and commenting on forums requires more secure passwords these days, (except where anonymous users are allowed). Ironically most email sites and ebay have more stringent security than most banks, for identification and passwords.Serious hackers would be better off sniffing your mobile\wifi data or sneaking into your network to steal your identity and all your personal security questions, before marching off to your bank to empty your accounts.As for the best passwords, the ones you can remember are the best, not any with an incomprehensible string of meaningless characters (although p@$5w0>d type character substitution is years ahead of plain english words as well as being memorable enough). An 8-character password using any combination of characters can take < 6 hours to crack, and many will take just minutes! Every time you add a character to your password, you are exponentially increasing the difficulty it takes to crack via brute force. For example, an 8-char password has a keyspace of 95^8 combinations, while a 20-char password has a keyspace of 95^20 combinations; (95 = keys on most keyboards).However, this only applies to brute force attacks. If your password is weak it does not matter how long it is, as it will likely fall to other attacks such as word-list and rule-based attacks. Pass phrases that are 15 to even 100 chars long fail easily because they are too simple. Unfortunately many websites restrict us to 10 characters and many require beginning capital and ending number, for example, massively limiting your security options.At present you best bet ensure your passcode is secure is to choose a text string that's randomly generated using Password Safe or another password management program.