What makes a password strong
An attacker doesn't try passwords by hand but automatically, depending on the method billions per second. Only one thing helps against that: making the number of possibilities so large that trying them all becomes hopeless. That number is determined by two quantities, the character set and the length, and the two work very differently.
The character set multiplies: allowing uppercase letters, digits and special characters alongside lowercase grows the pool from 26 to around 90 possible characters per position. Length, however, raises to a power: every additional character multiplies the total once more by the full pool. That's why length beats complexity: a password of 20 lowercase letters has more possibilities than one of 12 characters with every special character included.
The strength meter above the generator calculates exactly that and expresses it in bits. One bit more means twice as many possibilities. The figure only applies to randomly generated passwords like the ones created here, though. A self-invented "P@ssw0rd2026!" reaches similar values on paper but is trivial to crack, because attackers try exactly such patterns first.
Where the randomness comes from
A password is only as unpredictable as the randomness it's built from. This generator therefore uses the browser's cryptographically secure source of randomness rather than the usual standard function for random numbers. The latter is designed for speed and its output may be predictable, which is fine for toys but not for passwords.
We also take care to translate the randomness into characters without bias. The obvious approach, dividing a random number by the pool size and taking the remainder, systematically favours the front characters of the pool whenever the size doesn't divide evenly. Instead, the generator discards such random values and draws again, so every character is exactly equally likely. And: if a character type is ticked, it is guaranteed to appear at least once in the result.
What a strong password cannot do
Even a perfect password doesn't protect against everything. If a provider stores it in plain text and gets hacked, it's exposed regardless of its length. Anyone who types it into a deceptively realistic fake login page hands it over voluntarily. And anyone who reuses the same password turns someone else's data breach into their own problem.
That's why a strong password comes with two habits: a separate one for every service, and two-factor authentication wherever available. It is the single most effective protection there is, because a stolen password alone is then no longer enough.