There are two sides of password complexity, the administrator's side and the users' side. They are effectively disjointed requirements. Good complexity and policies of passwords are discussed often. But I have not seen any good guides or best practices for the users. All that is available are always those administrator's point of view best practices: Make a random complex long password and change it every other day...
In the end, the more complex requirements and policies are the more users will try to circumvent them by making simple passwords, writing them down, etc. but it is not their data they want to protect and ultimately, once the security is breached, you don't get your losses back.
I have been in both situations, as an administrator and now as a user who is forced into zero password history, full complexity and change every 60 days. Plus I have my other 10 complex passwords to remember. So I started using simple alphanumerical sequences like:
opqR678(. I know it is bad, but what the hell, my brain is limited and getting old.
Is there a good guide to construct non-random passwords that take into account zero history that can be remembered? (I do not need the password to be ultra strong, I know it cannot be done, but there are other barriers in place, firewalls, limited number of password attempts, physical access restriction, so I want the password to be considered strong with these extra barriers in place.)
What should I suggest to my users, as an administrator? How should they approach the password creation (sorry but NOBODY in the company is going to remember things like
gZ9]Rjm}t5d? which is now still considered weak and strong passwords start at 16 characters, that is idiotic)?