There are several ways to keep track of massive amounts of passwords. Which you choose is up to you, but each one has pros and cons.
I have used LastPass, KeePass, 1Password, and KeePassX.
If you want to be independent of software or services, you could come up with a simple algorithm that works on any website. I do this for security questions and it works well. (No more "mother's maiden name"!) For example, your little password formula could look like this (don't use this exact one):
Domain name of site + Num. characters in site name times two
+ a favorite phrase with punctuation + last 4 characters of URL shifted left by 1
Whatever you choose, consider:
- Upper/lower-case letters
- Non-alphanumeric characters (punctuation)
- Pseudo-randomness (shifting, swapping, modulus, etc; adds complexity, but it becomes habitual with practice)
The idea of memorizing a password algorithm is to create apparent entropy from actual order. Case in point... It doesn't have to be "cryptic" per-se, but at least long enough to be cryptographically secure so it can't be easily cracked with an automated process.
And yeah, don't write it down.
If someone finds your plaintext password because a site is exploited (like LinkedIn, on which I changed my password this morning), the attacker would still have to guess on other sites, especially if you swap, shift, or replace some of the characters systematically in your algorithm.
Take the example above, for instance. If an attacker saw your plain-text password from one site, what would he know?
- The first part is obviously the domain name of the current site
- The second part is probably the number of characters in the site name
- The next part is probably a static (unchanging) phrase
- The last part is... apparently random?
There is uncertainty generated by shifting the characters on the last part (that's a good thing). You could do this anywhere in a real formula... even the delimiters between different pieces, if you choose to have one, could come from the site or service name. For extra obscurity, shift the characters of your delimiter or any piece of the formula.
Security through obscurity isn't perfect, but for something memorable, you can't "bank" (no pun intended) on truly randomized data. If your password is long enough, you can stop most automated attacks, and if your password is obscure enough, you'll slow down an attacker enough to make it impractical to guess, giving you enough time to change your password.
PS. See the "Related" links on the side for discussions about this topic and pros and cons to each method.