[AF_Blue]

https://www.random.org/passwords/

Generate a list of random passwords, then mix in or add some special characters.

[paulcissa]

This is good advice and I would add that a second authentication factor (SMS, OTP, rolling token) essentially eliminates this threat.

Two-factor auth everywhere possible. Credential stuffing is expensive and processor-heavy and the second factor on an identity takes revenue away from the bad actors.