Generated locally with the Web Crypto API — nothing is ever sent to a server.
Some sites only accept a few symbols — pick exactly which ones are allowed.