Length and unpredictability matter more than forced symbol substitutions. For a password used as the sole authentication factor, NIST's current guidance requires services to accept at least 15 characters; a generator can produce longer unique passwords where a site permits them. Do not reuse the same secret across accounts.
Store generated passwords in a reputable password manager, and enable phishing-resistant multifactor authentication where available. If you must memorize one secret, a sufficiently long passphrase assembled from randomly chosen words can be easier to type than a random string. Avoid personal phrases, song lyrics, or familiar substitutions. Do not paste an existing password into an online strength checker: its score is only an estimate and the exposure may be unnecessary.
An important distinction: 16 random characters and 16 human-chosen characters do not provide the same strength. For generated passwords, 16+ characters is a strong practical baseline; for something you must remember, use a longer multi-word passphrase. Uniqueness matters more than scheduled rotation, and MFA protects against phishing and credential theft that brute-force estimates do not model. Never paste a real password into a checker—test a structurally similar example instead.
Akousa