Everything runs in your browser via the Web Crypto API. No data is sent to any server. PBKDF2 derives the key from your password (100k iterations + random salt).