Strong, random passwords generated on your own device.
A strong password is long (at least 12-16 characters) and varied (uppercase, lowercase, digits, symbols). Use a unique password for every site and, ideally, a password manager.
Never. It is generated locally with your browser's cryptographic generator (crypto.getRandomValues) and is neither transmitted nor stored.