How it is generated
Each character is drawn at random from a 64-symbol URL-safe alphabet — A–Z, a–z, 0–9, plus _ and -. The randomness comes from crypto.getRandomValues, the browser's CSPRNG, not Math.random, so the output is suitable for identifiers that should not be guessable.