How it works
Each character is chosen using crypto.getRandomValues, the browser’s
cryptographically secure random number generator, from a pool built out of
whichever character types you enable. Math.random() is deliberately not
used here — it is fast but not designed to be unpredictable.
Length matters more than complexity
A longer password with fewer character types can be stronger than a short one crammed with symbols, because length increases the number of possible passwords exponentially. Twenty random lowercase letters is harder to guess than eight random characters from every character type combined.
Ambiguous characters
Enabling “exclude ambiguous” removes characters that look alike in many
fonts — i, l, 1, L, o, 0, O — which is useful for a password
you expect to type by hand or read off a screen rather than paste.