Cryptographically random — generated entirely in your browser.
Yes. They use crypto.getRandomValues, the browser's cryptographically secure random number generator.
At least 16 characters for important accounts. Length matters more than symbols — and use a password manager so you don't have to remember them.