Password generator
Make a truly random password, or a passphrase of random words that is easier to remember. Then copy it into your password manager or the site.
Many sites ask for this. It removes a tiny number of possible passwords, and the strength below counts that.
Words are picked at random from a list of 7,776 English words, so each word adds about 12.9 bits. Capitals add nothing because everyone knows the rule; a random digit adds about 3.3 bits.
Made on your device with your browser's secure random generator. Nothing is uploaded or saved, and it is gone when you close the page.
Good habits
If one site leaks, criminals try the same email and password everywhere else. A different random password for each site stops that.
A password manager, including the one built into your phone or browser, can save and fill them for you. Then you only need to remember one strong passphrase.
A code from an app or a text message as a second step protects you even if a password leaks. Never share that code with anyone who calls or messages you.
Each extra bit doubles the number of guesses an attacker would need. 60 bits is about a billion billion possibilities. The figure counts how the password was made, so it holds only if it really was picked at random.
Sources: US National Institute of Standards and Technology, Digital Identity Guidelines SP 800-63B (long passwords and passphrases, no forced complexity rules, use of password managers, checking against leaked passwords); Electronic Frontier Foundation, "EFF Dice-Generated Passphrases" (2016) and its large word list of 7,776 words, used here under the CC BY 3.0 US licence (licence); W3C Web Cryptography API, crypto.getRandomValues, for secure random numbers. Strength is entropy in bits, worked out from how the password is made. The time to guess assumes an offline attack at 10 billion guesses a second; real attacks can be slower or faster.