A random passphrase is a good idea as has been said numerous times here. Two random dictionary words (from a 10000 word dictionary) is roughly as secure as a six random lower-case letters password, in practice this is quite weak (10000*10000 ~ 108, while 266 ~ 3 x 108).
If the hash is obtained and is a simple non-key-strengthened hash (regardless of whether their is a salt or not) it will take about a second to crack with a single modern GPU (which generates simple hashes (MD5, SHA-128/SHA-256/SHA-512, etc) at a rate of ~billion (109) hashes per second, assuming they know the method you generated your password (Kerckhoff's principle - always a good conservative assumption to make when analyzing a crypto-system).
Instead, I'd suggest a minimum of a four or five word passphrase; and for secure stuff e.g., encrypting your hard disk or an encrypted password list something like 7 to 9 words:
A five-word Diceware passphrase has an entropy of at least 64.6 bits; six words have 77.5 bits, seven words 90.4 bits, eight words 103 bits, four words 51.6 bits. Inserting an extra letter at random adds about 10 bits of entropy. Here is a rough idea of how much protection various lengths provide, based on updated estimates by A.K. Lenstra (See www.kelength.com). Needless to say, projections for the far future have the most uncertainty.
(Seven words from a 10000 word dictionary would take a billion modern gpus attacking at a billion attempts per second 317 years to brute-force).
But again beware reusing memorized passphrases at random places. First, you should never reuse passwords between different entities (any entity you give your password to, in theory could eavesdrop and record in plaintext). A malicious entity can even log incorrectly typed passwords and reuse at other places. Also a stupidly configured site may not allow long passphrases (spaces aren't allowed; or you need uppercase+symbols) or could silently truncate your passphrase (e.g., you only need to get the first/last 12 letters right and then it doesn't care).
That's why I suggest only using remembered passphrases for local stuff, passphrases for things I really need to remember (but still don't share amongst entities) like my email, and then having an encrypted list of unique randomly generated passwords/passphrases in the cloud on all my computers for everything else (besides a weak passphrase for stuff I don't care about being hacked). (I use keepassx as my password manager dropbox to keep the encrypted database shared amongst computers). I used to just use GPG and a bash script, but I find it has some handy features (like random password generation).