It's going to be as strong as they key you choose to use. It's not going to be secure if you use 'a' as your key. I get something from here and copy-paste into my devices: https://www.grc.com/passwords.htm

I VPN back somewhere if I'm using the connection for something I wouldn't want people to eavesdrop on. If you're just using it to check the news, watch YouTube, etc. it may not be necessary. Be wary of what cookies are transmitted or any other service that'll be logging on in the background though.

Packet sniffing is always a good thing to do (assuming you have permission and are doing so ethically). It's good to get used to seeing how things work.

Using a key like what I posted is going to give you a very secure connection. One of the main advantages of moving to Enterprise from PSK is key distribution, which isn't a big concern when you only have a small number of users.

You'll want to check out this book: http://www.wiresharkbook.com/

The capture and/or display filters will help you work with the data much more easily. It's overwhelming if you just look at everything simultaneously.

I like KeePass a lot. I think 32 random characters is overkill for most sites. Password length and complexity should be proportionate to the sensitivity of data/level of access. Random forums probably don't need passwords as strong as the ones for your bank accounts. It's also important to reuse passwords as little as possible. If a forum gets compromised, you don't want that to be the same info for critical accounts.

You might want to consider passphrases as well. They're much more easier to remember, yet they are still complex from a guessing perspective.

For example: Dinner?Pizza&17Beers!