Pick a length and the character types to include, then generate. Passwords are created in your browser with a cryptographic random generator and are never sent or stored.
Strength is measured in bits of entropy: the length times log₂ of the number of possible characters. Each extra bit doubles the guesses an attacker needs; 70+ bits is strong, 100+ is very strong.
Look-alike characters (0/O, 1/l/I) are left out so passwords are easy to read and type. At least one character from each chosen type is always included.
Use a different password for every account and keep them in a password manager.
Common questions
Is it safe to generate a password on a website?
Here, yes: the password is made by your own browser with crypto.getRandomValues and is never sent over the internet. You can even use the offline version.
How long should a password be?
At least 12–16 characters for important accounts. Longer is always better.