A string of (random) words is a perfectly fine password. There’s an xkcd I’m too lazy to get demonstrating it, but it genuinely does add enough randomness to break brute force.

Here’s the xkcd.