Your passphrase is generated entirely in your browser, the server never sees it.
You can also check if your passphrase appears in known data breaches via Have I Been Pwned. For your privacy, the full passphrase is never sent. Instead we send the first 5 characters of its SHA‑1 hash (k‑anonymity).