How the passwords are made
Every character comes from your browser's cryptographic random number generator (crypto.getRandomValues), the same source browsers use for encryption keys, rather than Math.random, which is predictable. Characters are drawn without bias, every type you tick is guaranteed to appear at least once, and the result is shuffled so they do not sit in a predictable place.
What the strength means
Strength is measured in bits of entropy: how many guesses an attacker would need, as a power of two. Each extra bit doubles the work. A 16-character password using all four types has about 103 bits, far beyond what any computer can try. Length helps more than anything else, so if a site lets you, go longer rather than adding more symbols.
Why it is safe to use here
The password is made in this page and shown only to you. It is not sent anywhere, not saved, and not logged, because there is no server involved. Once you close the tab, the only copy is wherever you put it, ideally a password manager.
Questions
How long should a password be?
At least 12 characters for everyday accounts and 16 or more for email, banking and your password manager. Every account should have its own, so a leak on one site does not unlock the others.
Are symbols necessary?
They help, but length helps more. A 20-character password of only letters and numbers is stronger than a 12-character one with symbols. Some sites refuse certain symbols, so turn them off if a site rejects the password.
What does "avoid look-alikes" do?
It leaves out characters that are easy to confuse when reading or typing a password by hand, such as l, 1 and I, or O and 0. It makes the password slightly weaker per character, so add a character or two to make up for it.