How it works
Each character is picked on its own with your browser's cryptographic random number generator (the Web Crypto API). Values that would make some characters more likely than others are thrown away and drawn again. Every kind of character you tick appears at least once.
The password is made on this page and nowhere else. It is not sent to PineKey, not saved, and gone when you close the tab.
How long should it be?
The US standard for digital identity, NIST SP 800-63B, asks services to require at least 15 characters when a password is the only thing protecting an account, and to allow at least 64. This generator starts at 20.
The same standard tells services not to demand a mix of character types. Length does most of the work: with all four kinds of character, each extra character adds about 6 bits of randomness.
What the meter shows
The meter counts the bits of randomness in the password you see: its length times the number of bits per character. The labels are our own scale: under 50 bits is weak, 50 to 69 fair, 70 to 99 strong and 100 or more very strong.
It applies to random passwords made here. A password a person makes up has far less randomness than its length suggests, so the meter says nothing about those.
One password per account
Use a new password for every account. If one service leaks its passwords, the same password on another service is then open too.
Sources
Keep it somewhere safe
A password you cannot find again is no help. PineKey keeps your passwords in a vault that is encrypted on your device, and lets you share logins with your family or team. Free for up to 3 people.