I should add that a password which you actually need to remember, like the master password to a password manager, should never be used online. The more isolatio

I should add that a password which you actually need to remember, like the master password to a password manager, should never be used online. The more isolation you can maintain the better. This way offline attacks against stolen hashes are unlikely to find anything, since they will only contain randomly generated passwords.