Cryptographically random, made on your device, never stored and never sent. Copy it straight into your password manager.
At least one character set stays on. Excluding look-alikes removes the characters I l 1 O 0 o and |, so the password is safe to read aloud or copy off paper.
Rough guide: under 50 bits weak · 50 to 80 fair · 80 to 128 strong · 128 and up overkill.
Entropy assumes the attacker knows exactly how the password was made, which sets and which length, and still has to try the combinations.
Length beats complexity. Every extra character multiplies the number of possibilities by the size of the pool, so going from 12 characters to 20 with the same sets is a bigger jump than adding symbols to a short one. Stretching the length is the cheapest strength you can buy.
Use a password manager, and one password per site. A random password is only useful if you never have to remember it, and reusing a strong password still means one breached site unlocks the rest of them. Generate a fresh one for every account and let the manager hold them.
Why the look-alike option exists. Capital I, lowercase l, the digit 1, capital O, the digit 0, lowercase o and the vertical bar are hard to tell apart in many fonts. If the password will be written down, printed, read out to somebody, or typed from a screenshot, excluding those characters saves an argument later. It shrinks the pool slightly, which the entropy number above already accounts for.
You don't have to take our word for it. Every browser has a built-in panel that shows everything a page sends or receives over the internet. On a computer (this doesn't work on a phone):