A password is only as good as the number of guesses it would take to find, and people are bad at producing that by hand — the ones we invent cluster around words, dates and keyboard patterns that cracking software tries first. This generator draws every character from your browser's cryptographic random source, so there is no pattern to exploit. It tells you how many bits of entropy the current settings give you, which is the honest measure of strength: each extra bit doubles the work of guessing. The password is generated in the page and is never transmitted, stored or logged.
No. It is produced by your browser's cryptographic random generator inside the page. Nothing is transmitted, nothing is written to storage, and closing the tab is enough to be rid of it.
Sixteen characters with mixed types is comfortably beyond brute force today; twenty gives room for the years ahead. Anything under twelve is worth replacing. The entropy figure under the password is the number to watch — 80 bits is strong, 128 bits is more than anything currently practical.
They count how many guesses an attacker would need, expressed as a power of two. Sixty bits means about a billion billion possibilities. It measures this password against blind guessing — it says nothing about whether you then reuse it, which is what actually ends most accounts.
They help, but less than people expect. Adding all the symbols to a 12-character password gains about 8 bits; adding four more characters gains about 26. If a site rejects symbols, make the password longer rather than worrying about it.
For anything you paste from a password manager, yes — it is shorter for the same strength. A passphrase of several unrelated words is easier to type and remember, which makes it the better choice for the handful of passwords you have to key in by hand, such as the one guarding the manager itself.