Password manager. The password for which you're best off randomly generating and memorizing if you're able (one of my grandparents can't remember a 4-digit banking PIN so that's a sticky note on the back of her card... do what one can).

Also memorize, if possible, a few other important things like your bank password, or rely on 2FA for that, e.g.: we have a system where you log in with a reader for your card itself, so your password being stolen and your chip+pin being stolen is a risk I accept. If someone is after me specifically enough to get physical things out of my pocket, I'm not confident about resisting a rubber hose for that password / they can also install a keylogger.

For generating a password, it just needs enough entropy if you calculate log(pool^elements)/log(2):

- pick 6 actually random words (like in the xkcd) from a 7776-word dictionary like diceware, or some other combination that gets you at least 72 bits of randomness (so here it is log(7776^6)/log(2)),

- or use a much shorter but slightly harder to remember set of random characters (a-z, A-Z, 0-9 would need 13 characters. If you don't want to bother with shift at all but include a few (10) symbols that don't need shift, add one character.

Depending on the password manager, it would strengthen with a KDF, but that depends on details and remembering just a handful of 72+ bits of randomness should be attainable for most people if they use it regularly (at least once or twice a month after the memorization phase).

I should really find a canonical source for this so I don't have to write this up every time. Not sure if Schneier has this somewhere but I looked at e.g. the Wikipedia on password strength (a source people would trust) and it's less explicit and also contained a pretty bad mistake for more than a year not so long ago...