On passwords, another alternative for me has been to use lyrics from obscure songs I know (ie. not pop, and not released the last 20 years!), with capitalization/punctuation (and avoiding the chorus) that usually takes me past 25 words long. Sometimes I'll add the year at the end just for some numbers (not sure if that matters though at this length). I figure it will never be bruteforced or guessed.