How this generator picks characters
It uses window.crypto.getRandomValues, the browser's cryptographically secure random number source, rather than Math.random(), which is not designed to be unpredictable enough for security purposes. Nothing is sent anywhere - the password is generated and shown entirely in your browser.
Why cryptographic randomness actually matters here
Math.random() is a pseudo-random generator built for general-purpose tasks like shuffling or animations, and its output can, in principle, be predicted by an attacker who studies enough of its results - a risk that's irrelevant for most uses but unacceptable for generating a secret meant to resist guessing. The Web Crypto API's getRandomValues is specifically designed to be unpredictable, which is the actual property a password generator needs.
Why length matters more than complexity rules
Once a password includes a reasonable mix of character types, each additional character increases the number of possible combinations an attacker would have to try far more than adding another complexity rule does - this is why current security guidance increasingly emphasizes length (12-16+ characters) over forcing specific symbol patterns, and why the length slider here goes well beyond the old "8 characters minimum" convention.
Why unchecking a character type shrinks the available pool
Each checkbox you uncheck removes that entire character set from what the generator can draw from - a 16-character password built only from lowercase letters has dramatically fewer possible combinations than one drawing from upper, lower, digits, and symbols together, even at the same length, which is why the strength indicator responds to both length and character variety together.