What makes a password strong
Length and randomness matter most. 16+ random characters or 5–6 random words cannot be brute-forced. The weak spot is reuse: one password on many sites leaks with the weakest of them. Keep passwords in a manager (Bitwarden, KeePass; you can self-host Vaultwarden) and turn on two-factor authentication.
Passwords come from the browser’s crypto.getRandomValues, the generator HTTPS uses. Passphrase words are from the BIP-39 list (2048 words), 11 bits each. Check your own password: strength checker.