Comment by hobarrera

It's never sent to the server; the key is derived from your passphrase, so it's never sent anywhere.

It's still possible for a sophisticated MITM to replace the JS code so that is DOES send the key somewhere.