Generated on your machine, never sent anywhere. No request leaves this page — turn off your wifi and it still works.
Characters come from crypto.getRandomValues, the browser's cryptographic random source, not Math.random — which is fast, predictable, and no use at all for this.
Strength is entropy in bits, worked out from the real pool of possibilities rather than guessed from how the password looks. Every extra bit doubles the work an attacker has to do.
The crack estimate assumes an offline attack at 100 billion guesses a second against a fast hash. A site storing passwords properly with bcrypt or Argon2 would take vastly longer — and one storing them badly could be quicker. It's a yardstick, not a promise.
Capitalising the first letter adds no entropy, because the position is fixed. It's there for sites that demand an uppercase, not because it makes anything stronger.