Length beats variety
Strength depends far more on how many characters you use than on how many kinds. Adding a character type raises how much each position carries by a little; adding positions multiplies that amount outright.
The entropy figure makes it plain. Twelve characters of mixed case and digits give 71 bits, while twenty characters of nothing but lowercase give 94. If a site refuses symbols, make up the difference with length.
What to aim for
Entropy is the number of guesses an attacker would need, written as bits. Each extra bit doubles that number.
Something in the sixties is fine for a throwaway account. Anything you intend to keep should sit above 80 bits, and a master password or an encryption key belongs above 100. This tool’s default of sixteen characters with all four types enabled comes to 102 bits.
Skipping look-alike characters
Zero and capital O, and the digit one against lowercase l and capital I, are indistinguishable in many fonts. If the password will be written down or retyped by hand on another device, leaving them out saves trouble. It costs five characters from the pool and a little entropy, so add a position or two to compensate.
When a site rejects symbols
Some services demand symbols and then reject particular ones. This tool leaves out quotes and angle brackets from the start, since those tend to need escaping wherever the password gets pasted. If a password is still refused, turn symbols off and add length instead.
After you generate one
The value is produced inside your browser and stored nowhere. It disappears when you close the tab, so copy it straight into a password manager.
More important than length is never using the same password twice. One breach then opens every other account, and a reused password is only as safe as the sloppiest service holding it — however long it happens to be.