Generated with the browser's cryptographic RNG, with the entropy stated honestly in bits — not a green bar that says "strong".
—
Where the numbers come from. Entropy is log₂(alphabetlength)
— the real size of the space an attacker must search, assuming they know exactly how the
password was made. That assumption is the honest one: security must not depend on the
method being secret.
Crack times assume offline guessing against a fast modern hash at 10¹¹ guesses per second.
Against a properly slow hash (bcrypt, argon2) it would be far longer — but you do not
control which one a company chose, so the pessimistic number is the useful one.
Randomness comes from crypto.getRandomValues, the browser's
cryptographic generator, with rejection sampling so no character is more likely than
another. Math.random() is not suitable for this and is not used here.