Use independently selected random words for a passphrase, rather than a quotation, lyric or sentence drawn from your life. A familiar phrase can be easier to guess even when it looks long. Give each account its own value and store the passwords you do not need to remember in a password manager.
Generate the words instead of choosing favourites
In Password Generator, choose Word passphrase. The current generator draws from the 7,776-word EFF long list using the browser's cryptographic random interface. It refuses generation if that secure randomness is unavailable.
The form allows three to ten words. Use six or more for important passphrases, subject to the receiving service's requirements. The lower end of the control is an available setting, not a recommendation for an important account. EFF's dice-passphrase guidance explains the random-word approach.
Choose a separator you can type accurately. A fixed dash, space or capitalization rule can help readability, but it adds no random choice. The optional two-digit suffix is randomly selected and adds another choice; it should not be used as a substitute for enough words.
Read the entropy estimate correctly
Each independently selected word contributes about 12.9 bits under this generator's model. Six words contribute about 77.5 bits and eight about 103.4 bits, before an optional suffix. These are estimates of the selection space, rather than predictions of how long a particular attacker will take.
Random-password mode instead uses selected character pools at a length of 8 to 128. When a character from every selected set is required, the displayed pool-based entropy is an upper bound. Neither mode checks whether you reused a value or whether an account, device or recovery method is compromised.
Fit the account and practise safe entry
Check the service's maximum length and accepted characters before saving a new value. Try entering the generated passphrase on the device you will actually use, confirm that the whole value is accepted and follow the service's recovery instructions.
For a password manager's unlock phrase, keep its recovery material according to the manager's guidance. Do not replace that guidance with a screenshot or a note in a shared folder. A lost device and a forgotten unlock phrase are different recovery problems.
Avoid entering a real password into unfamiliar checking sites. Password Strength Checker evaluates patterns locally and does not repeat the password in its result, but its score is only an estimate and it does not check breach databases. A trusted manager's own check is a useful place to start.
Protect the account around the passphrase
Clipboard history, synced keyboards and screen sharing can expose a copied value. Clearing the current clipboard may leave older history entries. Use a device you trust, and avoid displaying or sharing a generated secret.
Enable an appropriate additional authentication method where offered. Passkeys and security keys can provide phishing resistance that a typed password does not. Keep recovery codes private and follow the service's instructions for storing them.
NIST's digital identity guidance supports long passwords, password-manager use and paste, and rejects arbitrary periodic password changes. For an individual account, replace a value when it may have been exposed, is reused or the service requires a justified reset. A random passphrase still needs a trustworthy device and a sound recovery setup.