window.crypto.getRandomValues(), the browser's cryptographically secure random number source — not Math.random(), which is predictable and unsuitable for secrets. Generation happens entirely on your device: nothing is transmitted, logged, or stored.