Generated entirely in your browser. Never sent anywhere, never stored.
Uses your browser's cryptographically secure random number generator (crypto.getRandomValues) — the same kind used for encryption keys, not a predictable Math.random().