Recent advice is that a password should have both upper and lower case letters, at least one number, and some places may require at least one "symbol" (@#$%^&* etc). Anything with at least 8 total characters is considered "hard to crack," but not necessarily really secure.

Sites that require a mix of numbers, upper and lower case, but limit you to 6 or fewer characters are considered "questionable." Where it's allowed, ten total characters are generally considered "reasonably safe" and some respectably secure sites will allow all numbers and/or all u.c. or l.c. letters if you use ten or more total chars.

Recommendations do change regularly, depending on what's been hacked recently; but they seldom get simpler.

For sites that include "questions" for secondary identification, it's recommended that you ALWAYS LIE. When they ask for your "favorite teacher's name" you give them something totally phony (But "Mrs Cratchet" is overused). "First school you attended" should NEVER be anyplace you actually have been to (Alaska Swine Breeding Institute?). Your "mother's maiden name" was ElbertinaMergabstruse or something similar (unless that was her name). They'll use whatever you tell them when you set up the "account" and it should be something that NOBODY might find mentioned anywhere in any way associated with you.

John