Passwords
A password nobody will guess, including you.
Random characters from your browser’s cryptographic random number generator. Let your password manager remember them. For the few you have to type, use a dice passphrase instead.
How long to crack it
Average time to guess it, assuming the attacker knows the length and which characters you allowed.
How it picks characters
Each character is drawn from the sets you tick with crypto.getRandomValues, using rejection sampling so no character comes up more often than another. If a set you ticked doesn’t appear at all, the whole password is thrown away and drawn again, because many sites insist on at least one digit or symbol. Nothing is sent anywhere, and the password is gone when you close the tab.
Twenty characters from all four sets gives about 130 bits, far beyond any attacker. Some sites cap the length or reject certain symbols. When that happens, shorten it or untick symbols and add length to make up for it. Then add a second factor, since a strong password does nothing against a phishing page that captures it.