I believe it's generated from your password which is why you used to have to enter it with every action. Now web client stores it for awhile, but I don't think it is stored on server.