Decided to go and check. They use the browser's "window.crypto.getRandomValues" to generate the random number. Which supposedly uses the system random number generator.