On your key sites, anything with your credit card stored, bank, identity information (DoB, NI number) this is critical.
Just to add to Alistair's great advice, also make sure that for anything critical, ensure that 2-Factor authorisation is also set up so that even if they have your password they will still need access to one of your physical devices like your smartphone.
I don't know if Windows does this (I expect it does but I've never bothered to look), but on Macs there is not only a built-in password manager that generates strong passwords for you, but also a very handy 'Hide my email address' feature which creates a dummy email for you to use on sites that then re-directs to your Apple mail account. That way you don't have to give your real email address to anyone you don't know.
