A strong password is long, unique to one account, and stored somewhere you do not have to memorize it. The passphrase method gives you all three without a random string of symbols you will forget.
The passphrase method
Pick four random words that have nothing to do with each other, for example copper, tractor, mango, and lantern. Choose your own words, and do not use words tied to your life, such as a pet, a team, or a birthday.
Add a number and a capital letter somewhere, and separate the words with a symbol if the site allows it.
Make it at least 16 characters long in total. Length matters more than symbols.
Use a different passphrase for every important account. Reusing one password means one leak opens everything.
Store it in a password manager
Use the password manager already built into your browser or phone: Google Password Manager in Chrome, iCloud Keychain on iPhone and Mac, or the password manager in Microsoft Edge.
When you create or change a password, let the manager save it, and let it fill it in next time you sign in.
Protect the account the manager syncs through with two-factor authentication, since that account guards all the others.
For a dedicated option, a standalone password manager such as Bitwarden or 1Password works across every device and browser.
Turn on two-factor authentication
In the account's security settings, turn on two-factor authentication (2FA).
Use an authenticator app rather than text messages when you have the choice.
Save the backup codes somewhere safe, such as printed on paper kept at home.
Never share a password or a verification code with anyone, including someone who says they are support. Real support never asks for them.
Need one right now? Use the RunTimeIndex password generator to create a random password, then save it in your password manager.
Common questions
How long should a password be? At least 16 characters for important accounts such as email and banking. Longer is better, and a four-word passphrase usually clears 16 characters easily.
Are passphrases better than random passwords? For passwords you must remember, yes. For the rest, let a password manager generate a long random password and store it for you.
Should I change my passwords regularly? Not on a fixed schedule. Change one immediately if the service reports a breach, or if you reused that password somewhere that leaked.