Have 3 levels of passwords like above, stuff, important stuff, and top secret stuff.
Each level I have 5 different passwords, they are 2 words, two or 3 numbers and a special character. all 12 charactes long. In the situations where I have to change or use a different password I use one of the other 5 for that level. Can usually make 5 attempts before being lock out for some period of time.

At work we require 14 characters but you don't have to use special characters so you could have a password that is "Pelican Parts forums are great".

There was an article in Arstechnica a few months ago that showed how insecure 2FA is as well. As in it really does not add anything but inconvenience.

For online stuff, none of it matters when the host site is the one that gets breached. It also doesn't matter if you are one to fall for a phishing scheme and later wire 48 million to an off shore account. Ask Ubiquity.

forget password Monday morning
call IT
repeat