You know perfectly well what you ought to be doing: for each site you visit, you should be choosing a different, complex sequence of letters, numbers and symbols, and then memorising it. (That's rule number one of the conventional wisdom on passwords: never, ever write them down.) But you don't do this, because you weren't blessed with a brain that's capable of such feats.

So instead you use the same familiar words for every site – your dog's name, the name of your street – with occasional ingenious permutations, such as adding "123" at the end. Or maybe you do try to follow the rules, in which case you're probably constantly getting locked out of your bank account or trying to remember the answers to various absurd security questions. ("What was your favourite sport as a child?") And things are getting worse: these days, you find yourself forced to choose passwords with both upper- and lower-case letters, and what normal human being can remember multiple combinations of those? Not you, that's for sure.

One reason not to feel too guilty about your bad password behaviour is that it seems to be almost universal. Last month, an analysis of leaked pin numbers revealed that about one in 10 of us uses "1234"; a recent security breach at Yahoo showed that thousands of users' passwords were either "password", "welcome", "123456" or "ninja". People choose terrible passwords even when more is at stake than their savings

Password hacking takes many different forms, but one crucial thing to understand is that it's often not a matter of devilish cunning but of bludgeoning with brute force.

This is where the length of your password makes an almost unbelievable difference. For a hacker with the computing power to make 1,000 guesses per second, a five-letter, purely random, all-lower-case password, such as "fpqzy", would take three and three-quarter hours to crack. Increase the number of letters to 20, though, and the cracking time increases, just a little bit: it's 6.5 thousand trillion centuries.

Then there's the question of predictability. Nobody thinks up passwords by combining truly random sequences of letters and numbers; instead they follow rules, like using real words and replacing the letter O with a zero, or using first names followed by a year. Hackers know this, so their software can incorporate these rules when generating guesses, vastly reducing the time it takes to hit on a correct one. If you think you've got a clever system for coming up with passwords, the chances are that hackers are already familiar with it.

The least hackable password, then, would be a long string of completely random letters, numbers, spaces and symbols – but you'd never remember it. However, because length matters so much, the surprising truth is that a longish string of random English words, all in lower case – say, "awoken wheels angling ostrich" – is actually much more secure than a shorter password that follows your bank's annoying rules, such as "M@nch3st3r". And easier to remember: you've already formed a memorable image of some noisy wheels waking up an ostrich fishing by a riverbank, haven't you?

One day, we may not have to worry about any of this: there are innovations in development that might replace passwords entirely. Touchscreens could be configured to detect subtle aspects of your interactions with your computer – the distances between your fingers, the speeds at which you tap and scroll.