Follow these two rules:

No obvious context, and obfuscate them.

Like no URL's and meaningful descriptions

Tac on the end or beginning extra chars that you don't actually use.

But ideally, being viewable isn't good, in case your screen gets captured. And the storing of them should be encrypted.

Passwords should be entered by a paste action, never typed (key logging is a vulnerability).

Cnet site often has top ten lists, I use the open source keepass.org one myself, and download it from GitHub.