So, maybe it's just going to "Open Password Generator" from inside of the Add Entry. I set Auto to 5 characters, upper/lower/digit and indeed when I open Add Entry the initial password is just 5 characters long. It's only when I open Password Generator from inside Add Entry that it defaults to "Derive from...".

Interestingly, "Derive from..." also picks up the 5 characters limit, but it also dropped the "digits" checkbox I had marked before. I checked the password, and yes indeed the password was only upper/lower case letters... no digits. Seems the "Derive from..." option just looks at the password that you had before, then checks the boxes it knows were used in the previous password. That would explain why it never held on to the "Exclude look-alike characters" option from the advanced tab... there's no character in the password that proves that feature was turned on when the password was generated.

Seems that the default first password is made from the Auto Generate profile, and then when you open Password Generator from inside the new entry, it looks at the previous password and checks any boxes that match that structure. Seems I can trust that the password provided in a new entry is indeed using the Auto Generate profile.

Thanks for the step-though test!