Generated locally in your browser using a cryptographically secure random source — nothing here is sent anywhere.
crypto.getRandomValues (a CSPRNG, not Math.random), guarantees one character from every type you've enabled, then shuffles the result.