Let's see if I don't remember anything here.
There are 3 ways to crack an account without directly obtaining the password (keylogging, getting you to disclose it, or just watching you) afaik.
These are human guessing, machine brute-force techniques, and the sexy one where it's a breach of the site itself and passwords are leaked through it, but there's only one thing you can do about that one.
short (4-8, let's say), random sequences are easy for a machine to break but near impossible for a human (assuming 0 lead). These may actually be useful for a home computer with a properly configured firewall.
dictionary words are also easy to attack with a machine, and are pretty easy for a human to figure. Even permutations of the word.
longer strings of words and phrases are safer, probably possible to brute-force given the pattern, but to the point that it would be easier for a human, and there based mostly on existing knowledge.
really long random sequences (i'm tired so how about 16+) are pretty much unbreakable but also usually involves writing it down... unless it isn't actually random but instead you just think you're clever.
In all cases, never reuse passwords. Even dummy ones can be modified slightly each use.
Never use names including of states, countries, provinces, actorscharacterscompanies.
Don't fuck around with secret questions and just pick the two dumbest ones and generate 16 characters of fun and write them down.
In general don't make accounts unless you actually need it.
Don't store your passwords plaintext on any network.
that seems about right. i am ready to be destreddy
