Passphrase or Random String? Pick by Where the Password Actually Lives
"Use a mix of upper case, lower case, a number, and a symbol" has been the default advice for decades, and it's largely why so many passwords look likeTr0ub4dor&3: hard to type, hard to remember, and, it turns out, not even the most effective way to make a password strong. The actual answer depends less on complexity rules and more on one question: do you ever type this password yourself, or does something else type it for you?
What changed in the guidance
NIST's Special Publication 800-63B, the US government's digital identity guidelines that much of the industry treats as the de facto standard, moved away from mandating forced complexity rules. Requiring a symbol and a number doesn't reliably make a password harder to guess, it mostly makes people predictably substitute "@" for "a" and add "1" at the end, patterns crackers already account for. The updated guidance instead treats length as the primary driver of strength and explicitly permits, and effectively encourages, passphrases: multiple random words strung together, checked against breach lists rather than policed by composition rules.
Source: NIST SP 800-63B, Digital Identity Guidelines: Authentication and Authenticator Management
The decision rule: does a human type it, or does a manager fill it in?
This splits your passwords into two genuinely different categories with different requirements.
Passwords you type by hand — your device unlock code, and above all your password manager's master password, since everything else depends on it — should be a memorable passphrase: four or more random, unrelated words, not a quote or a sentence someone could guess from knowing you. Something like four dictionary words chosen at random is both long enough to be strong (length is what matters, and four words is a lot of characters) and dramatically easier to type correctly and remember than a forced symbol-substitution string like Tr0ub4dor&3, which is both harder to recall and, ironically, not meaningfully more resistant to a targeted guessing attack because the substitution pattern itself is well known.
Passwords a password manager autofills — every other account login — should be the opposite: a fully random, 16+ character string with no attempt at memorability at all, since you will never type it. Memorability has a real cost (it narrows the space of passwords humans actually pick) and zero benefit once autofill removes the need to remember anything. There's no reason to pay that cost on an account you'll never type into by hand.
Generating the random half
For the accounts in the second category, Password Generator produces a fully random string at whatever length you set, with no memorability compromise, since your password manager is the one that has to remember it, not you.