Strong, random passwords and passphrases from a cryptographically secure generator (crypto.getRandomValues) — never Math.random. Everything runs in your browser; nothing is generated on or sent to a server.
crypto.getRandomValues
Math.random