Ubuntu currently recommends using APG (Automated Password Generator) to create strong yet pronounceable passwords.
I usually use it like this (see option explanations here):
apg -s -m 16 -x 16 -M SNCL
This creates passwords of length 16, containing at least one character from each of 4 classes: small letters, capital letters, numerals, and special symbols, using a manually entered seed.
However, I think I have noticed a flaw: passwords usually contain only one digit and one special symbol, and one of them is usually located in the end of the password (sometimes in the beginning). Here's an batch of 16 passwords I just generated:
TelHulp5Ot*Graj8
notDodsOwgid5ut<
EywiJudCof8drog_
DuerfigOkCif0Ov~
udBon9opyivyawl@
@2drakBanRewyooc
abAxKec0quacJej>
Sam9?Trobhecvun[
RypMycs`Frewjij5
orEs%KooHujsayt7
Dunwib1flynjead_
Hud+quonEdDairr5
Aj|oj7owojadEmp4
@Shmeeb0quicOam_
CribDip9drefBag[
LocEwCyWrarl#on9
How much this flaw decreases the password entropy? Are such passwords still secure this days? I'm mostly concerned about using them for accounts at various websites.