Yes. They use crypto.getRandomValues(), the browser's cryptographically secure random number generator, with rejection sampling to avoid modulo bias. Math.random() — which many online generators use — is explicitly documented as non-cryptographic and must never be used for secrets.
Are the passwords sent anywhere?
No. Generation happens entirely in your browser and no request is made. This is non-negotiable for a password tool: a generator that transmits its output is generating passwords for someone else too.
How long should a password be?
For anything that matters, 16 characters or more from a mixed alphabet — that is roughly 100 bits of entropy, comfortably beyond offline brute force. The default of 20 gives about 128 bits. Length contributes far more than exotic symbols: a longer password from a smaller alphabet beats a short one with punctuation.
What does the entropy figure mean?
It is length × log2(alphabet size) — the number of bits of true randomness in the generation process, and therefore the log of how many guesses an attacker needs on average. Below 60 bits is weak against offline attack; 90+ is strong; 128 is beyond practical brute force. Note it measures the process, not the specific string.