A lot of people sign up for accounts using something like "birthday plus initials" or their phone number typed backwards — it feels complicated enough to them, so it feels safe. In reality, to a hacker, that kind of password is barely a speed bump. Once you understand how passwords actually get cracked, it's a lot easier to see what really works.
There are two common methods. One is the "dictionary attack": hackers take massive databases of real passwords leaked online, plus common word combinations, and try them en masse — any password built from a birthday, a name, or a common word gets cracked almost instantly. The other is "brute force": a computer simply tries every possible character combination one by one. The shorter your password and the fewer types of characters it uses, the less time it takes to exhaust every possibility.
Plenty of people think swapping in an exclamation point or replacing "a" with "@" makes a password safe. In reality, hackers' cracking dictionaries have long since covered those exact substitution patterns. What actually matters is length — every extra character multiplies the number of possible combinations exponentially. An 8-character password can be brute-forced with modern hardware in a matter of hours, sometimes minutes, while a random string of 12+ characters can push the cracking time out to something effectively impossible.
If you used a particular password to sign up on Site A, and Site A's database later gets breached, hackers get hold of that batch of "username + password" pairs — and then they try those same combinations on banks, email providers, and social media accounts en masse. This is called "credential stuffing." Even if none of your other accounts were directly breached, reusing a password means the risk has already spread to every single place you've ever used it.
It's genuinely hard for the human brain to come up with a truly random string of characters — we unconsciously fall back on familiar patterns, like keyboard sequences, common words, or personal details. A password generator creates a random string with none of that baggage, and it's not tied to any personal information. No need to second-guess whether you've made it "complicated enough" — just adjust the length and character types (uppercase, lowercase, numbers, symbols) to match whatever a given site requires.
Legitimate websites never store your password as plain text in their database — instead, they store a "fingerprint" generated by a hashing algorithm (like MD5, or the more secure SHA family). If the database leaks, what hackers get is that hash value, not your actual password, and reversing a hash back into the original password takes significant extra effort. Try typing some text into an MD5 tool and you'll get a feel for how a piece of text turns into a seemingly meaningless string of characters — understanding this concept also helps you judge how seriously a given site takes security.
I read the password generator's code and counted its actual character pool with all four sets ticked: 24 uppercase letters (I and O removed), 25 lowercase letters (l removed), 8 digits (0 and 1 removed) and 13 symbols, for 70 characters in total. The formula is: number of possible passwords = pool size to the power of the length, and entropy in bits = length multiplied by log2(70), about 6.13 bits per character. At 12 characters that is 70 to the 12th power, roughly 1.38 x 10^22 possibilities, or about 73.6 bits. At 16 characters it is 70 to the 16th power, roughly 3.32 x 10^29, or about 98.1 bits. Each extra character multiplies the count by 70, so a 16-character password has 70^4, or 24,010,000 times, more possibilities than a 12-character one. For comparison, 8 characters give only about 5.77 x 10^14 possibilities, or 49.0 bits. One caveat: the strength figure shown on the tool page treats lowercase as 24 letters, so it shows 73 bits for 12 characters instead of 73.6; at 16 characters both round to about 98 bits.
If you've got a few accounts whose passwords haven't changed in years, or several sites sharing the exact same password, spending a few minutes right now running them through a password generator is one of the highest-value security upgrades you can make.