Making them all different is correct advice and impossible to memorise. What actually works.
The most common way accounts fall is not guessing but taking a list leaked from one service and trying it on others. However complex a password is, reusing it across sites means one breach opens all of them. Making them different comes before making them complicated. Automatically trying leaked lists against many sites needs no human effort, so it costs attackers almost nothing and happens constantly.
Requiring capitals and symbols is an older standard; length matters far more in practice. A long passphrase built from several memorable words is both safer and easier to remember than something short and convoluted. Using a well-known quotation verbatim is the case to avoid. Stringing together four unrelated words, for example, gives something easy to remember yet very hard to hit by brute-force guessing.
If everything is different you cannot memorise it, so it has to be stored somewhere. Dedicated managers are built for this, and you only memorise one master password. Whatever you use, a breach of the store exposes everything, so the master password must be one used nowhere else. When choosing a manager, look at how long it has been around, whether syncing between devices is encrypted, and what recovery exists if you forget the master password.
It is realistic to assume a password can leak at any time. With two-factor enabled, knowing the password is not enough to sign in. An authenticator application or a hardware key is safer than codes by text message, and whichever you use, store the recovery codes separately so losing a device does not lock you out. Authenticator applications need a transfer step when you change phones, so check how before switching devices.
Trying to fix every account at once means never starting. Begin with accounts that act as a recovery route for others. If your email is breached, everything else can be reset through it, so that comes first, followed by anything holding financial or payment details, then the rest. Switching on two-factor for your email account should also come first.
When a service you use reports a leak, change that password at once, then change it everywhere else you used the same one. If the sign-in history or list of connected devices shows access you do not recognise, sign those sessions out, and turn on two-factor if it was off. Emails or texts about the breach may themselves be phishing, so do not click their links; go to the site directly instead.
Forcing password changes on a fixed schedule tends to produce predictable patterns, such as bumping a final digit each time. Guidance from the US National Institute of Standards and Technology (NIST) has also moved away from recommending periodic forced changes. Without signs of a leak, keeping long and unique passwords and changing them promptly when a breach is suspected is the realistic approach. Where an employer or institution sets a change interval by policy, though, that policy applies.
Even the strongest password is useless if you type it into a fake sign-in page. Check the address of any sign-in page opened from a link in an email or text, and if in doubt, go in through a bookmark or the app. A manager's autofill does not work on a look-alike site with a different address, so treating a failed autofill as a warning sign is a useful habit.