Choosing a password for an account like this one
What actually makes a password hard to guess, why reuse is the real danger, and how passwords are stored here.
Length beats cleverness
Four or five unrelated words are stronger and far easier to remember than a short password full of substitutions. copper lantern drifting beacon is a better password than P@ssw0rd!23, and you will still know it in a year. Every guessing tool in existence already knows that a becomes @.
Reuse is the actual risk
Nobody sits and guesses passwords one at a time; they take the millions already leaked from other sites and try them here. A unique password for this account means those lists are worthless against it, however weak or strong it looks.
The way to have a unique password on every site is a password manager. Any of them is better than none.
How it is stored
Your password is hashed with WordPress's standard password hashing before it is stored, so what sits in the database is not your password and cannot be turned back into it. A password reset issues a single use, time limited token by email; it never contains or reveals your existing password.
Changing it
Under Profile, and it requires your current password. Changing it signs out every other session immediately and invalidates every issued token, which is exactly what you want if you suspect somebody else has been in the account.
Two factor still matters
A long unique password makes guessing hopeless. It does nothing about a password stolen from you directly, by a convincing fake sign in page or a keylogger. Two factor authentication is what covers that, and on an account whose vaults can be quietly paused it is worth the two minutes.
Still stuck?
The assistant has read every page in this help centre and answers in seconds. If it cannot help, a person will.