Length is what actually helps
Every extra character multiplies the number of possibilities. Adding four random characters helps far more than swapping an "a" for an "@", because attackers already know every substitution people make.
A reasonable target today is 16 characters for accounts that matter and 20 or more for the password protecting everything else, such as your email or password manager.
Random, not clever
Human-invented passwords cluster. Names, dates, keyboard patterns and the same word with a number on the end appear in cracking dictionaries by the million.
A generator does not have habits. Let it produce the string, store it in a password manager, and never try to remember it.
When a passphrase is better
For the handful of passwords you must type from memory, four or five unrelated words are both strong and typeable. Keep them genuinely unrelated — a quote or a song lyric is not random.
The part people skip
Reuse is the real danger. A perfect password used on two sites is only as safe as the weaker site. Unique passwords everywhere, plus two-factor authentication on email and banking, matters more than squeezing out extra characters.
Generate passwords locally when you can. A generator running in your browser never transmits the result, so there is nothing in a server log to leak.