Strength combines three factors: length (up to 40 points, maxed around 20 characters), character type diversity (up to 30 points for using all four types: uppercase, lowercase, numbers, symbols), and entropy in bits (up to 30 points). The total score of 0-100 maps to a category from Weak to Very Strong.

It's an estimate of how long an attacker would need to guess your password through brute force, based on the total number of possible combinations (character set size raised to the power of length) divided by an assumed guessing speed — about 1,000 attempts/second for an online attack and 100 billion attempts/second for an offline attack against a stolen password hash.

Only if you'll need to type the password manually or read it aloud — excluding characters like 0/O/l/1/I reduces typing errors slightly but also slightly reduces the character pool and entropy. If you're using a password manager to store and paste it, there's no downside to leaving them in.

This generator runs entirely in your browser using JavaScript's random number functions — no password is transmitted to a server or stored anywhere. Still, best practice is to save any generated password immediately into a reputable password manager.

Entropy grows exponentially with length but only linearly with character-set size. Adding a few extra characters to a password typically increases its crack-resistance far more than adding a couple of extra symbol types to a short password.