At this point, most people should be using a password manager. All of my passwords are the longest the site will allow (usually 64 random letter, number, and symbols).
In addition to this, 2FA (non-SMS) should be enabled where available (it's supported on most important sites now like Hosting, Paypal, many banks).