Most people assume that any password generator, especially one built into a well-known password manager, is automatically using strong randomness. That is usually true for the major, established managers, but it is not a safe assumption to make about every generator you run into, including small browser extensions, in-house tools built by a company for internal use, or older software that has not been updated in years. The underlying randomness source matters a lot more than people expect, and it is worth knowing how to sanity-check it.
Not all randomness is created equal. A pseudo-random number generator like JavaScript's Math.random() is built for speed and statistical distribution in things like games or simulations, not for security. Its internal state can, in principle, be reconstructed from a series of observed outputs, which makes anything generated from it theoretically predictable to someone who knows what they are doing. A cryptographically secure random number generator, such as crypto.getRandomValues() in the browser or os.urandom() on a server, draws entropy from sources designed specifically to resist this kind of prediction. The difference is not academic. It is the difference between a password that is genuinely unguessable and one that only looks that way.
For a web-based generator, open your browser's developer tools, go to the sources or debugger tab, and search the page's JavaScript for Math.random versus crypto.getRandomValues. If a tool is not open source and you cannot inspect the code directly, look for an explicit statement from the vendor about what random source they use. Reputable tools are usually happy to say so, since it is a selling point. If a tool goes out of its way to avoid answering that question, or a support page just says "strong randomization" without specifics, treat that as a mild warning sign rather than a guarantee.
It is worth keeping this in perspective. A 20-character password generated from a weaker pseudo-random source is still, in practice, far stronger than a short, human-chosen password, because the search space from length alone is already enormous. The randomness-source problem becomes serious mainly in specific scenarios: if an attacker can observe many outputs from the same generator and has the skill to reconstruct its internal state, or if the generator uses a predictable seed like the current time. For most people, this is a reason to prefer a properly sourced generator when one is available, not a reason to panic about passwords already in use.
The Password Generator on this site uses crypto.getRandomValues()specifically so this is not something you have to take on faith. Open your browser's dev tools while using it if you want to confirm that for yourself, and treat any generator that makes that hard to verify with a bit of healthy skepticism.