A great way to go about it is workflow and impact if the account was breached or access was lost. For me, most services don’t matter that much although I use otp if I can. I have the main password database somewhere, and for less impactful service and often used ones, they are on the keyring system (protected by disk encryption). And keys have passphrases.