Although I generally agree with you (and don't get me started on "never write it down") its the "small ticket" items like email, facebook, LinkedIn, etc, etc than can cause the long term problem. If someone gets your complex bank account password, then they've probably got your password for most of the other services you use online (because you've made it complex and hard to guess you've probably reused it everywhere). Identity theft is a short step away, and the first time you'll know about that is when the bank is asking why you haven't kept up the payments on the 50k loan you took out last month. Agreed, this event will make you aware that someone's got your password, but its a painful way to find out. I used to work in IT and security was part of my remit. As far as passwords were concerned, my take was: 1) make it long or complex (long is better), 2) have a few characters within it that you can easily change and re-remember, 3) if you want to write something down, write down only the bits you won't remember and leave a hint for the rest, and put it somewhere out of context (i.e. not stuck to your monitor!). If your reminder doesn't look like a password (e.g. "garden$gate then dob, this month" meaning perhaps "garden$gate03057510") then by all means stick it in your wallet. I'm certainly more paranoid about losing my wallet in the office than leaving some random bit of paper on my desk accidentally. It needs to be a pragmatic approach, but some IT Security Officers just don't try to balance security and usability.