Result
152 bits · Very strongCharacters
How this one works
Every character comes from crypto.getRandomValues, the browser's cryptographically secure random number generator. Math.random is never used: it is fast, but its output can be predicted. The bytes it returns are mapped onto your chosen character set with rejection sampling: any byte that would land unevenly across the set is discarded rather than reduced with %, so every character stays exactly as likely as every other one.
The bit count above is the real entropy of what you've configured (length times log₂ of the character set size), calculated rather than estimated from patterns.
Questions
How secure is it?
It uses crypto.getRandomValues, the cryptographically secure generator behind WebCrypto, which the browser seeds from the operating system. There is no homemade shuffle and no seeded pseudo-random generator involved.
Does this reach a server?
No. Generation happens as JavaScript in this tab, and the result is never sent anywhere, copied only to your own clipboard when you ask.
Why exclude characters that look alike?
Reading a password back off a screen or a printout, 0 and O, or 1, l and I, are easy to mis-type. Turning this off gets you a very small amount of extra entropy back; on, it costs about 0.1 bits per character.
How long should this be?
For an account password, 16 characters from all four sets is about 101 bits, which reads Very strong here. The field starts at 24 (about 152 bits), which is plenty for an account. For an API key or session secret you generate and store yourself, 32 or more is a comfortable choice.