,
16
Strong, random passwords made in your browser. Nothing is sent anywhere or stored.
The single biggest factor in a password's strength is length, not a clever mix of symbols. Each extra character multiplies the number of possible combinations an attacker must try, so a long random passphrase beats a short cryptic one every time. A genuinely random string of 16 characters or more, like the ones generated above, is effectively impossible to brute-force with today's technology, whereas a short password with a "$" swapped for an "s" is guessed in seconds by software built for exactly that.
Unique per site is the rule that matters most. The most common way accounts get taken over is not clever cracking but reuse: one site suffers a breach, and attackers try the leaked email and password on dozens of other services. If every account has a different random password, a breach at one site cannot spread. That is impossible to do in your head, which is why a password manager is the right companion to a generator: it creates and stores a unique strong password for every login, and you only remember one master password.
Do the basics too. Turn on two-factor authentication wherever it is offered, so a stolen password alone is not enough to get in. Never enter a password on a page you reached from an unexpected email link. And do not build passwords from personal facts (names, birthdays, pets) that a stranger could find or guess.