Cryptographically random, generated in your browser (crypto.getRandomValues). Never sent anywhere.
crypto.getRandomValues