Filled in from this page's address — you usually don't need to change it.
Your passphrase never leaves this device and is never stored. It derives the encryption key, which is kept in the browser in non-extractable form. The server only ever sees ciphertext.