See how long a password would hold out against an attacker, and generate a strong one in a click.
Checked in your browser. Nothing is sent or stored.
Yes. The strength check runs entirely in your browser. Your password is never sent to a server or stored anywhere.
With zxcvbn, Dropbox's open-source estimator. Instead of just counting character types, it looks for dictionary words, names, keyboard patterns, dates and repeats, then estimates how many guesses an attacker would need.
Roughly how long an offline attack would take against a properly hashed password (about 10,000 guesses a second). Against a weakly protected database it could be far faster, so aim for "Very strong".
Use the generator above or a password manager such as Bitwarden or 1Password. Long passphrases of random words work well. Avoid personal details, and never reuse a password across sites.
A password manager. It creates and remembers a unique password for every site, so you only need one strong master password. Turn on two-factor authentication wherever you can.