Every tool on this site should be auditable by the person using it. This page explains what each tool checks, how any score is calculated, and where the limits are.
Password strength uses a pattern-aware estimate rather than a simple character count: dictionary words, keyboard walks, repeats, dates and character substitutions all reduce the effective strength, and the result is shown against four different attack speeds. Leak checking uses k-anonymity, so only the first five characters of a hash of your password ever leave your browser.
The link checker and the email header analyzer use heuristics, not a blocklist. They can tell you that something looks wrong and why, but they cannot prove a site is safe. The domain email security check reads public DNS records and grades them against the published standards for SPF, DKIM and DMARC.