Passwords should just be random numbers, and services should provide a suggested password on the sign up pages. Here's a 128 bit password: CR4EOJ5ZYQRKCGQV4OLN2ZRFS.
Better than all that is public key authentication.
Unfortunately there are so many ideas that will "never" gain ground. People are still stuck with the user/password paradigm and it will take some serious push to move to something like Passkeys, which is obviously the best if implemented correctly (i.e. provide a fallback when using a non-own device)
We need a push like it happened for HTTPS, which became widespread in less than a decade, but that basically means Google has to push for it.
Better than all that is public key authentication.