As an example, the chorus of the classic CCR song 'Have you ever seen the rain' (don't use this one) will give you a easy to remember 15 char password: Iwkhyestrcdoasd. And if you forget its easy to make a simple hint (something like 'Fogerty').
My advice, don't use the chorus - a 2nd or third verse you remember is better (and often longer). And google the lyrics before you make the password, just to check that you've been singing the right words all these years.
These types of things are very misleading. It is rare for a password to be bruteforced in general, it is unusual for the attacker to have the hashes of the actual site for an offline attack. Hopefully if the dev is competent there is rate limiting for an online attack. If the dev is competent they are hashing with argon2, pbkdf2, bcrypt etc tgat slows things down.
Anyways - 95% of password based attacks are using the same password in multiple places with one of the other sites getting hacked (someone's probably going to point out exceptions, and they do exist). Unless your password is absolutely terrible, the threat is not lack of password complexity but lack of password uniqueness.
Just to put it in perspective - 2FA is usually a six digit number, and that is considered secure since there are rate limits, and the user cannot reuse the key on multiple site. The security.org site says that can be cracked in 25 microseconds. There is obviously more to it then that since 2FA codes last more than 25 microseconds.
I do share those two (different) passwords around the machines I own, (ie: all login passwords are the same, and the iCloud password is shared of course) but I don’t see that as extending my risk at all. All of those machines are under my control for the login, and I know how well Apple secure the iCloud one.
Or much less time because it's already been leaked three times according to haveibeenpwned.com, so it'll already be in a bunch of rainbow tables.
This is why clever isn't enough: not because you can't design one that's resilient to brute force attacks but because password reuse is the #1 threat to the password-oriented security model and you can't come up with hundreds of sufficiently strong clever passwords.
A decade or so ago, because I had to learn it for a school recital and know the poem backwards, I used Jabberwocky: Tbatstdgag1tw! - according to security.org’s password-strength-checker [1] that will take a computer 200,000,000 years to crack, presumably on average. I use a longer one today, and I skip words too, and some words I use 2 letters from - a similar string of characters to my current password is estimated at a trillion years.
At one point, I was using the first 2 lines of “Sea Fever” by Masefield, but that got too long to type - ImgdttsattlsatsaaIaiatsatstshb … If you’re interested, that’s 2 septillion years. I don’t need to be that secure :)
[1]: https://www.security.org/how-secure-is-my-password/