The passwords people invent are far more predictable than they feel. Substituting a 3 for an E, adding a 1 and an exclamation mark, building on a pet's name or a birth year - every one of those patterns is in the wordlists that cracking tools work through first. A password that feels clever is usually just a common pattern with a personal detail in it.
Randomly generated passwords have no pattern to exploit, which is the entire point.
Where the randomness comes from
This generator uses your browser's cryptographic random number generator, the same facility used for generating encryption keys. It is not Math.random(), which is fast, convenient and predictable enough that a determined observer can infer future values from past ones.
The selection is also unbiased. A naive implementation takes a random number modulo the alphabet size, which makes the first few characters of the alphabet marginally more likely than the rest. The bias is small but real, and it is avoided here by discarding values that would skew the distribution.
Length beats complexity
If you take one thing from this page, take this. Adding a character to a password multiplies the search space by the size of the alphabet. Adding a character class only widens the alphabet a little.
A 16-character password of lowercase letters alone has more possible combinations than a 10-character password using every class on the keyboard. Length is the variable that matters, and it is also the easier one to remember if you are typing the password rather than storing it.
The practical advice: 16 characters is a sensible default for an account you will store in a password manager. Go to 20 or more for anything that protects other credentials - your email account, your password manager's own master password, a cloud provider's root account.
The character type options
All four classes are on by default. Turn symbols off if a site rejects them, which some banks and older systems still do. Turn off whatever else a site's rules force you to.
Exclude ambiguous characters removes l, I, 1, O, 0 and o. Use it when the password will be read aloud, written down, or typed from a screen onto another device. It slightly reduces the alphabet, so add a character or two to compensate.
The generator guarantees at least one character from every class you enable, then fills the rest from the combined pool and shuffles the result. That satisfies the composition rules sites impose without weakening the randomness by putting the required characters in predictable positions.
The part the generator cannot do
A strong password you reuse is a weak password. Breaches are constant, and credential stuffing - taking the passwords from one breach and trying them everywhere else - is one of the most effective attacks there is. Unique passwords per site, held in a password manager, and two-factor authentication where it is offered. The generator handles the first requirement; the other two are on you.