Good luck remembering them all, also change them all every 30 days, so here are my secrets.

Password expiry hasn't been considered best practice for a long time (must be at least a decade now?) largely because of the other points you mentioned; it leads to weak easily memorable passwords written somewhere easily accessible. Even when it was considered good 30 days would have been an unusually short time.

Current advice is to change passwords whenever there's a chance it's been compromised, not on a schedule.

Or, just use a password manager and simplify your life. Reusing any password is bad practice, even if the account doesn't seem important. Every account really should have a randomly generated unique password. A password manager solves all of these problems.

Yeah, no. Computers don't care if a password is complex or not. It can't read "words". That complexity stuff was introduced because humans think like humans, and wanted to force people to use words not easily found in a dictionary. Security is about password length, so +@#£h&1g/?!:h&£( is equally as vulnerable to a brute force attack as abcdefgh1234567 because of how modern encryption works, it I length that counts.

It is good advice to use a formula to build memorable passwords. I like a simple sentence you can type them without thinking about, as this also won't appear in a dictionary (avoid famous movie quotes, use something meaningful to you).

Fact is complex passwords created a new security risk; the written down password. Also, frequent forced password changes made it worse. Most businesses only ask staff to change passwords every 3 to 6 months these days. And web sites.never asks you to change your password.

The dirty (not so secret) secret is that, the biggest risk to security is not how complex your password is, but how easy it is to trick people into just giving away access to their accounts.

These days MFA is what makes logon credentials safer and passkeys are slowly proving that passwords themselves are not worth it for most systems.

tl;dr - complex passwords are a throwback and not better than long memorable ones like 1Verycrappycode!

This is full of terrible advice. Password rotation is an outdated practice.

Don’t ever reuse passwords with “zones”, just use a password manager to generate long and secure passwords for every account. Then enable MFA wherever possible, and Passkeys where they have been implemented.

Then have a recovery method for the password manager stored in a secure place.

This is a method I heard once for remembering random passwords that I thought was clever.

Create your own alphabet of words (or random characters). A is for Apple, B is for Boy, C is for Cat…etc.

For every letter in the URL, you use the word from your alphabet. Ex:

www.facebook.com

F = Fog, A = Apple, C = Cat, E = Egg, B = Boy, O = Off, O = Off, K = Kite

Next, you need a number if you didn’t use one in your alphabet.

Facebook is 8 letters long so I might use 8. Or only letters repeated once. Or maybe you use the whole URL. Up to you, but you do it the same way for every site. You create a patter that you follow and can remember, rather than remembering every password.

Need a symbol? Assign that to the top level domain. In my example, .com = # .edu = ? .org = * etc

Put it all together and my example password would be “8FogAppleCatEggBoyOffOffKite#”.

A password for google.com might be ‘6GolfOffOffGolfLogEgg#’.

Obviously, you don’t have to do it this exact way with the alphabet, number, and symbol. The idea is that you create a set of rules that you remember and follow. If you write down “A = Apple B = Boy…” and someone finds it, it won’t be instantly obvious that it is meant for passwords.

Is using a password manager for your phone recommended or no?

Have . and ; and / in the middle of your passwords. If a site is compromised and email + passwords are taken, these are usually stored in a csv file. If someone attempts to delimit the csv data, these characters can split you password into multiple cells.

How do passwords get scraped?