What actually makes a password strong, how to generate a random one in seconds, and the habits (password managers, 2FA, no reuse) that matter more.