Where the randomness comes from
The generator uses crypto.getRandomValues, the Web Crypto interface to the operating system's cryptographically secure random number generator. That source is designed so that observing any amount of previous output gives no useful information about what comes next, which is the property that matters when the string is a password or a token.
This is a different thing from Math.random. That function is a fast pseudo-random generator seeded from an unspecified source, with no security guarantee at all: its internal state is small, its output is predictable to an attacker who has seen enough of it, and browser implementations explicitly document that it must not be used for anything security-related. The tool falls back to it only if the secure source is unavailable, which in practice does not happen in current browsers.
The values are drawn as 32-bit integers and reduced into the character set with a modulo operation. When the set size does not divide 2 to the power 32 evenly this introduces a slight bias toward the earliest characters, but the effect is on the order of one part in a hundred million for a 62-character set and has no practical bearing on the strength of a generated string.
How to think about entropy
The strength of a random string is measured in bits of entropy, calculated as length multiplied by the base-2 logarithm of the character set size. Lowercase only gives 26 characters, about 4.7 bits each. Adding uppercase gives 52, about 5.7 bits. Adding digits gives 62, about 5.95 bits. Adding the symbol set here gives 88, about 6.46 bits.
So a 16-character string from lowercase, uppercase and digits carries roughly 95 bits, and the default 16-character mixed string is comfortably beyond brute force with any foreseeable hardware. A 12-character string from the same set is about 71 bits, which is still strong for an online account with rate limiting but noticeably weaker for something an attacker can attack offline.
The arithmetic only holds if the string really is random. A password a person invented and then described as random has far less entropy than its length suggests, because human choices cluster. This is also why adding a symbol is worth less than adding length: going from 62 to 88 characters adds half a bit per character, while adding four more characters adds twenty-four.
Choosing a character set for the target system
Symbols cause more practical trouble than their entropy contribution justifies. Some systems reject particular punctuation, some silently truncate at a length you cannot see, and a string containing a quote, a backslash or a dollar sign can break when it passes through a shell command, a configuration file, a YAML document or a connection string without careful quoting. If the string will be handled by scripts, an alphanumeric set and a few extra characters of length is the more robust choice.
For identifiers rather than secrets the considerations reverse. A string that a person will read aloud, retype or transcribe benefits from excluding visually similar characters such as 0 and O, 1, l and I. This tool does not offer that filter, so for human-facing codes a dedicated alphabet such as Crockford base32 is a better fit.
Length limits deserve a check before you generate. A system that silently truncates a 64-character password to 20 leaves you with a credential that does not match what your password manager stored, which usually surfaces later as a login failure that is hard to diagnose.
What a random string is and is not suitable for
It works well as a password for a specific account, as an API key or a shared secret between services, as a session or invite token, as a database seed value, and as a random file name or test fixture. In all of those the string is stored somewhere and compared, and its only job is to be unguessable.
It is not a UUID and should not be used where one is expected. A UUID has a defined format, a version field and, in version 4, a specific 122 bits of randomness, which is what lets systems recognise and validate it. A random alphanumeric string of similar length is not interchangeable.
Two handling notes matter as much as generation. The string is rendered into the page and usually reaches its destination through the clipboard, so anything that can read page content or the clipboard can read it; generate secrets in your password manager when you have one. And nothing is stored here, so a string you generate and navigate away from is gone.