Holy crap, some of this is plain bad advice. Did you even do a decent amount of research before writing this?
1) I can crack a completely random 6 character password in seconds on my computer. 8 Characters might take a minute or two. 12 characters is around where it starts to get "harder" - 344 thousand years, but that's just one computer. 12 is good enough for "normal" users - but if you really have something to keep secure people with unlimited resources could still crack that in a reasonable amount of time (with unlimited funds - you can purchase computer time and run several million computers together - so that takes the crack time down to a few days, albeit it will cost you many thousands of dollars). Adding just one more character to 13 makes it pretty good for now, but computers do get faster.
2) Adding a punctuation mark inside a regular word is nearly as bad as just picking a word - advanced password checkers will run through the dictionary and for every word will do many thousands of permutations like this.
3) Same thing with replacing vowels with common substitutes - the programs will check all these things.
4) misspelling is marginally better, but only if the password is long enough to start with.
Here is a funny XKCD.com comic that explains this in pretty simple terms http://xkcd.com/936/
Here is a web page that will tell you how long it takes to crack a given password by a single desktop http://howsecureismypassword.net/ (note you probably should not test your actual password there, just feed it something similar).
How can you write an article like this and not even touch upon password managers (lastpass, 1password and keepass being the 3 prominent ones - I use lastpass, my master password is 22 characters long - mostly random and *every* password for anywhere else is 20 random characters (or as long/complex as the system will let me use).
If you really wanted to get technical you could touch upon two factor authentication too, a growing number of sites allow that.
I get that the point of writing articles on a site like wisebread.com is a game of monetization, but how about we not give out information that actually makes it *easier* to hack someones password?
Lastly here's a good article about what happens when you become lax about passwords - even ones you consider secure (up until I switched to lastpass I was guilty of this myself even though I clearly knew better, using the same randomly generated 9 character password I got as a freshman in college back in 1993, granted that's *still* more secure than most people's passwords even today, it isn't enough if you care about losing your data). http://www.emptyage.com/post/28679875595/yes-i-was-hacked-hard




















