Generated locally with the browser's cryptographic randomness (crypto.randomUUID and crypto.getRandomValues) — never Math.random.
crypto.randomUUID
crypto.getRandomValues
Math.random