In practice, I generate random passwords (at least 14 characters long, if the system allows it, which is silly there are sites that don't) with 1Password. LastPass is another option, but that stores data in the cloud which might unsettle some people. Keypass is yet another option I've seen mentioned.

These types of systems/platforms should force stronger passwords. WordPress is no different. Remembering, especially if you have more than one WordPress site, them might be a pain, which is understandable. (With ManageWP, that isn't a problem.)

Everyone is better off with better (and if that means it needs to be forced, then so be it) security practices.