Mediawiki -> PasswordFactory.php -> generateRandomPasswordString(), see also https://www.mediawiki.org/wiki/Manual:$wgPasswordPolicy

PasswordFactory.php

<?php
	/**
	 * Generate a random string suitable for a password
	 *
	 * @param int $minLength Minimum length of password to generate
	 * @return string
	 */
	public static function generateRandomPasswordString( $minLength = 10 ) {
		// Decide the final password length based on our min password length,
		// stopping at a minimum of 10 chars.
		$length = max( 10, $minLength );
		// Multiply by 1.25 to get the number of hex characters we need
		// Generate random hex chars
		$hex = MWCryptRand::generateHex( ceil( $length * 1.25 ) );
		// Convert from base 16 to base 32 to get a proper password like string
		return substr( Wikimedia\base_convert( $hex, 16, 32, $length ), -$length );
	}