Ubuntu currently recommends using APG (Automated Password Generator) to create strong yet pronounceable passwords.
I usually use it like this (see option explanations here):
apg -s -m 16 -x 16 -M SNCL
This creates passwords of length 16, containing at least one character from each of 4 classes: small letters, capital letters, numerals, and special symbols, using a manually entered seed.
However, I think I have noticed a flaw: passwords usually contain only one digit and one special symbol, and one of them is usually located in the end of the password (sometimes in the beginning). Here's an batch of 16 passwords I just generated:
TelHulp5Ot*Graj8 notDodsOwgid5ut< EywiJudCof8drog_ DuerfigOkCif0Ov~ udBon9opyivyawl@ @2drakBanRewyooc abAxKec0quacJej> Sam9?Trobhecvun[ RypMycs`Frewjij5 orEs%KooHujsayt7 Dunwib1flynjead_ Hud+quonEdDairr5 Aj|oj7owojadEmp4 @Shmeeb0quicOam_ CribDip9drefBag[ LocEwCyWrarl#on9
How much this flaw decreases the password entropy? Are such passwords still secure this days? I'm mostly concerned about using them for accounts at various websites.