This generates random passwords using your browser's cryptographically secure random number generator
(crypto.getRandomValues), not Math.random() — the difference matters, since
Math.random() is predictable enough that it should never be used for anything security-related.
A 20-character password using only lowercase letters is harder to brute-force than an 8-character password using every character type. If you're choosing between a longer, simpler password and a shorter, more complex one, take the length.
Generating a strong password is only half the problem — the other half is not reusing it. A password manager lets you use a unique, maximum-length password for every account without needing to remember any of them.
Use at least 16 characters with all four character types for important accounts.
100% client-side — nothing generated here is ever transmitted.