A good password is long and unique. Length matters more than complicated symbols: a phrase of several words is often stronger and easier to remember than a short word full of special characters. Above all, a password should only be used for one account.
Nobody can remember dozens of unique passwords. That is what a password manager is for: a vault protected by a single master password, which remembers and fills in the others for you.
Two-factor authentication adds a second proof on top of the password, for example a code on your phone. Even if your password is stolen, access usually remains blocked. Turn it on first for your email, your bank, your website and your social media.
The most common trap: turning on two-factor authentication without keeping the backup codes. The day you change or lose your phone, you are locked out of your own accounts. Backup codes must be stored in a safe place, separate from the phone.
Also be wary of messages asking for a code or a password, even if they seem to come from your bank or a well-known service. A reputable service never asks for your two-factor authentication code by message or by phone.