One thing is for sure, don't use the same password for all your important sites. To make them easier to understand, have a system of differentiating from 1 site to another. As always, I try to: 1) numbers and letters 2) not a real dictionary word 3) Mix of lower and uppercase

My real paranoia is still: "what if this/that website doesn't encrypt or hash my password?"