The best password is one you cannot remember, because it is a long string of characters chosen entirely at random and kept in a password manager. Human-made passwords have patterns: a capital letter at the start, a number at the end, a word from the dictionary with an “@” for the “a”. Attackers know all the patterns. A truly random password has none to exploit.
Set the length and the kinds of character, choose how many passwords you want, and they appear. Press Generate again for new ones.
How they are made
The passwords come from your browser’s secure random number generator, the same source used for cryptographic keys, not from the ordinary random function that is meant for games. The code takes care to avoid a subtle bias: when it picks a character from a set, it throws away random values that would favour some characters over others, so each character has exactly the same chance.
It also guarantees at least one character from each kind you have ticked. If you ask for upper case, lower case, numbers and symbols, every password contains all four, as websites with composition rules require. The password is then shuffled so that these guaranteed characters do not always sit at the front.
Nothing is sent over the internet or saved. The password exists on this page until you leave it or generate another one.
Length matters more than complexity
Each extra character multiplies the number of possibilities an attacker has to try. With all four kinds of character ticked and look-alikes skipped, there are 80 possible characters, so each one adds a little over 6 bits of strength. A 16-character password has about 100 bits, which is far beyond any realistic guessing attack. A random 12-character one still has about 76 bits. By contrast, a short password with a complicated look, such as P@ssw0rd!, is weak because it is predictable, however many symbols it has.
Modern guidance from standards bodies such as NIST has moved away from forced complexity and regular changes, and towards long passwords, checking against lists of known breached passwords, and using a different one for every site. A generator makes the first and last of those easy.
Settings explained
Skip look-alike characters leaves out O, 0, l, 1 and I, which look alike in many fonts. That is useful if you will ever have to read or type the password by hand, and costs very little strength. Symbols are drawn from a set that most sites accept: !@#$%^&*()-_=+[]{};:,.?. Some sites reject certain symbols, and if one does, untick symbols and make the password a few characters longer instead.
Use it sensibly
Use a different password for every account, store them in a reputable password manager, and turn on two-factor authentication where it is offered. If you must remember a password, for instance for the manager itself, use a passphrase of several unrelated words rather than a random string.
For locking up some text rather than an account, the protected text tool encrypts it in your browser with a password you choose. The random word generator and random letter generator have different jobs, and neither is a substitute for this one.