If they aren't memorable then they are something you have, not something you know. Now you are down to one factor.
To put it another way, what would you suggest for a master password for the token management software?
To put it another way, what would you suggest for a master password for the token management software?
Like, what if you pick the corpus of a novel that you've read as your master password. And the password manager uses that novel plus several other novels that you have selected (but didn't read/won't read?) to give you a series of multiple choice selections to determine if you know the right book. Just a few short passages. Preferably with proper nouns stripped out.
You have to select the passages from the correct book for all the multiple choices. That way rather than recall, the memory factor is recognition. Combine it with a non-memorable token which you have to present first in order to even see the recognition factor test and you might have something workable.
number of options * number of questions
This is essentially the same "password reset questions" loophole that allowed the apple cloud storage hack on a bunch of celebrities.
I dunno, just a thought, but do you get what I'm saying about recognition vs recall? Why don't we have the computer test us about things we're good at if part of the test has to be something only our individual brain is capable of?
For now, I guess it looks like a master password, which yes this paper elucidates methods for. But as long as you're memorizing 1 password (not 400), then how you manage to memorize it is of fairly small systemic gain.
Jut generate random password and memorize it, like you memorize other random numbers and strings, like lock combinations, room numbers, car numbers, etc. Learn how to memorize arbitrary long strings of characters and you will have no problems with them for rest of your life.
To make life easier, memorize short password first, e.g. Gc@b%, let call it "alpha", then, when password expired, memorize two new short passwords, "beta" and "gamma", and include your old password "alpha" between them (or rotate it, or flip, or use part of it, etc.), so your password will 2 times longer and stronger. Repeat procedure next time. In short time, you will have list of "words" - short pieces of random strings, which are hard to guess by strangers, but remembered well by you. You can use that dictionary to construct new passwords while keeping adding new random or non-random "words" to dictionary, e.g. "car" - something related to your car, "house" - something related to house, etc. Then your password might look like "alpha-car-beta-house", which is easy to remember by YOU, but hard to guess.
Even if you use the limited Diceware list (7776 words) you get 7776^7 which is plenty.
> Gc@b%
26 upper, 26 lower, 10 numeric, 20 special chars (which are risky to use)
82^5. 3707398432. That's weaker than the 3 words phrase from a 50,000 dictionary, which is a phrase that no-one recommends and that you rejected as being too weak.