There's a nice write up about how it works located on GameFAQs . It seems to cover everything that you are asking here is an excerpt:
To explain the mechanics of the password system, it's necessary to
note the limitations of it. The system is not designed to record your
exact position in terms of lives, health, or amount of progress made
through any one of the levels. It doesn't even record progress made
into the stages beyond the initial eight bosses. Instead, the
passwords keep track of only 24 binary variables.
These 24 variables have only two possible values, true or false. What
this means is that all they keep track of is whether you HAVE
accomplished a certain feat, or HAVE NOT accomplished that feat.
There's one for each of the eight bosses, to keep track of whether
you've defeated each of them or not, another eight for each of the
heart tanks, to determine if you've collected them or not, four more
for the sub-tanks, and another four for the armor upgrades you can
gather (boots, helmet, mega buster, and body armor).
Also from the same link above someone apparently made a Mega Man X password generator which can be found here.