Four character sets, and a guarantee that at least one of each shows up
Turning on uppercase, lowercase, numbers, and special characters builds a combined pool of 88 possible characters — 26 uppercase, 26 lowercase, 10 digits, and 26 symbols (!@#$%^&*()_+-=[]{}|;:,.<>? ) — that the rest of the password is drawn from at random. Before that random fill happens, the generator sets aside one character from each selected class and inserts them at random positions afterward, so a password built with all four classes on is guaranteed to actually contain all four, not just statistically likely to. The password-length slider's own minimum of 4 exists for exactly this reason — it is the smallest length that can fit one guaranteed character from each of the four classes.
The "avoid ambiguous characters" option removes exactly seven characters
Switching this on filters i, l, 1, L, o, 0, and O — letters and digits that look alike in many fonts — out of the pool before either the guaranteed characters or the random fill are chosen. It is useful for a password that will be read aloud or typed from a printed slip; it has no effect on the special-character set, since none of those seven ambiguous characters are symbols.
PIN Mode is a different, simpler generator entirely
Turning on PIN Mode ignores every character-type checkbox and generates a string of digits only, using the length slider for how many. There is no guaranteed-character logic to worry about since there is only one class to draw from, and the strength meter below the output disappears entirely in this mode — a string of digits at PIN lengths is not evaluated against the same criteria as a general-purpose password.
What the strength meter actually measures — and what it doesn't
The meter is a small additive point system, not an estimate of how hard a password would be to guess or crack. It awards one point each for reaching 8, 12, 16, and 20 characters, and one point each for containing a lowercase letter, an uppercase letter, a digit, and a symbol — eight points maximum, mapped to Weak (0–2), Fair (3–4), Good (5–6), or Strong (7–8). The consequence is worth knowing before trusting the label: a 20-character password of nothing but lowercase letters scores 5 points (length thresholds at 8/12/16/20, plus one for containing lowercase) and lands on "Good" — the identical score and label a much shorter password like Passw0rd! gets from mixing four character classes at only 9 characters. Both read "Good" on this meter; they are not equally hard to guess.
Typing your own password scores it, and reverse-engineers its settings
Typing or pasting directly into the password field, instead of clicking Generate, does two things at once: it feeds that text through the same strength meter described above, and it inspects what you typed to flip the uppercase, lowercase, numbers, and special-character checkboxes to match whatever classes it detects — so checking an existing password's composition and strength score takes no extra step beyond pasting it in.
Where the randomness comes from, plainly stated
Every character this generator produces, in every mode, is drawn using JavaScript's Math.random(). That is fast and gives an even spread across the chosen character set, but it is not a cryptographically secure random source — a determined attacker with enough computational insight into the generating process has a theoretical edge that a proper CSPRNG closes. For an everyday account password this distinction rarely matters in practice; for something that needs to resist a well-resourced, targeted attacker specifically, a generator built on a cryptographic RNG is the more defensible choice. Everything here runs locally in the browser and nothing generated is transmitted anywhere.