Every password here comes from crypto.getRandomValues — the browser's cryptographically secure generator — not Math.random(), whose output is predictable enough that passwords built from it can be reconstructed by an observer. Length runs from 8 to 64 characters, with independent toggles for uppercase, lowercase, digits, and a 13-symbol set (!@#$%^&*_-+=?).
Rejection sampling, or why the obvious code is subtly biased
The obvious implementation maps each random byte to a character with byte % charset.length. With all four sets enabled the charset is 75 characters, and since 256 is not a multiple of 75, characters early in the set would be selected slightly more often than the rest — a bias an attacker modeling the generator gets to exploit for free. This generator instead discards any byte of 225 or above (225 being the largest multiple of 75 that fits in a byte) and draws again, so every character is exactly equally likely. You cannot see the difference in the output; it is the difference between uniform and almost-uniform.
The entropy arithmetic
With the default sets (uppercase, lowercase, digits — 62 characters) each position contributes log2(62) ≈ 5.95 bits, so the default 16-character length delivers about 95.3 bits; enabling symbols raises that to 16 × log2(75) ≈ 99.7. Anything above roughly 80 bits is beyond brute force with current hardware, so both figures are comfortable — and the numbers reveal which control matters. Adding the symbols toggle at length 16 buys about 4.4 bits; moving the slider from 16 to 24 buys about 47.6. Length is the lever.
Two implementation notes worth knowing: the on-screen Weak/Medium/Strong label uses a deliberately rough approximation (it treats every enabled set as 26 characters), so trust the arithmetic above over the label; and unchecking all four boxes does not error — generation silently falls back to lowercase-only.
The password strength checker gives checklist-style feedback on any candidate, and bcrypt is how a generated password should be stored server-side — never with a fast hash.