Use your browser's password manager to generate random passwords.
In the rare case you need to manually enter your password into a site or app be very suspicious and very careful.
Never give personal information to someone who calls or emails you. If necessary look up the contact info of who called you yourself and call them back before divulging and details. Keep in mind that Caller ID and the From address of emails can be faked.
Update software regularly. Security problems are regularly fixed.
That's really all you need. You don't even need 2FA, it is nice extra security but if you use random passwords and don't enter your passwords into phishing sites it is largely unnecessary.