For staff of The Open University, please visit the intranet and look to IT Guidelines on Information Security.
In 2017 The National Institute of Standards and Technology in the US published their comprehensive advice on password security.
Unlike previous recommendations, their advice is not to include complicated symbols or numbers but to group together three or more words, ideally words that would not appear together in a sentence, for example:
If you think that might be hard to remember, you could use something described as a password phrase like:
Some systems will force you to have to use numbers and symbols so it's a good idea to have a version of the passwords above and simply exchange a letter for a number if forced to. That way you will still have a secure password but you'll be within any given rules.