What makes a password strong?
Length beats cleverness. Every extra character multiplies the number of possible passwords, so a 20-character random password from the full 94-character set carries about 131 bits of entropy — far beyond what any brute-force attack can search. Substituting a with @ in a dictionary word, on the other hand, adds almost nothing: cracking tools try those substitutions first.
How this generator works
Characters are drawn with crypto.getRandomValues(), the cryptographically secure random number generator built into your browser — never Math.random(). Characters are sampled without modulo bias. Candidates are then accepted only when every selected character class appears; the entropy estimate accounts for that constraint. Generation happens entirely on your device: open your browser's network tab and you'll see that no generated value ever leaves the page.
Practical advice
Use a password manager and give every account its own random password — the one case where you should prefer a passphrase is the handful of secrets you must type from memory, like the password manager's master password. The "no ambiguous characters" option removes 0/O and 1/l/I, which helps when a password has to be read aloud or retyped from paper.