I've just reset my Apple ID password. It's now 21 characters log, includes upper and lower case, contains digits, wasn't used in the past year and it's strength is still only 'moderate'.

So as far as Apple are concerned, I'm guessing the only really secure password is one you can't actually remember.