Something matters more than complexity. Organised around how accounts are actually compromised.
Choosing a defence requires knowing the attack. Accounts are most often compromised not because a password was guessed, but because some service you registered with was breached and that password was then tried elsewhere โ credential stuffing. However complex a password is, reusing it means one breach opens everything.
Mixing in symbols is an old convention; length is the far stronger defence. Long and memorable generally beats short and complex. One caveat: combining unrelated words is good, but using a well-known phrase or lyric verbatim is not, since those already sit in attack dictionaries.
Using a different password everywhere is correct advice, but memorising dozens is impossible โ which is why a password manager is the realistic answer. You remember one strong master password and the software generates and stores the rest. If you will not use one, at least make your important accounts entirely distinct. Email matters most, since every other service's reset link arrives there.
Even if a password leaks, a second factor blocks the login โ which makes two-factor authentication far more valuable than added complexity. Methods differ in strength: SMS is vulnerable to number takeover and weaker than an authenticator app or hardware key. Even so, SMS is vastly better than nothing.
Periodic change used to be standard advice. Forcing frequent changes was found to make people adopt predictable patterns โ incrementing a trailing number โ so recent security guidance has moved away from recommending scheduled changes. Changing immediately on news of a breach is what matters.
The password generator and strength meter on this site run entirely in your browser; nothing you type or generate is transmitted or recorded. As a general habit, though, avoid typing passwords you actually use into arbitrary websites.
Each button runs this keyword on that search engine