I use randomly generated passwords that are unique per site. It is more likely for someone to socially engineer the site support (or the registered mail account

I use randomly generated passwords that are unique per site. It is more likely for someone to socially engineer the site support (or the registered mail account) than to guess it. Another annoying thing is that some sites do not consider your password enough even if you do not have 2fa enabled and they insist on sending you a mail (thanks github! - I can't connect to my account there because the registered mail was in my old domain) or an sms (thanks google/twitter! I had not even provided my phone number yet somehow giving it to you will verify that it's me)