How it works
Each word is picked on its own from a published list of 2,048 English words (the BIP-39 list), with your browser's cryptographic random number generator. The passphrase is made on this page and nowhere else. It is not sent to PineKey, not saved, and gone when you close the tab.
How strong is it?
A list of 2,048 words gives 11 bits of randomness per word, because 2,048 is 2 to the power of 11. Seven words, where this generator starts, give 77 bits; each extra word adds 11 more. The meter uses the same scale as the password generator: 70 to 99 bits is strong, 100 or more very strong.
This holds only when the words are picked at random. A phrase you choose yourself, such as a line from a song, has far less randomness.
When a passphrase is the better choice
Words are easier to type on a phone and to read out to someone than a string of symbols. That makes a passphrase a good fit for the few passwords you have to type yourself: your computer, your phone, or the master password of a password manager.
The NIST standard tells services not to demand a mix of character types, so a passphrase of lowercase words should be accepted where the rules follow it. Some services still ask for a digit or a capital letter; add one at the end if they do.
Sources
Keep it somewhere safe
A password you cannot find again is no help. PineKey keeps your passwords in a vault that is encrypted on your device, and lets you share logins with your family or team. Free for up to 3 people.