In their FAQ[1] (under the heading: "How is my data encrypted? I’m concerned about submitting it to unknown and untrusted servers. Can it really not be decrypted by anyone but me?" or if you click on "Show more FAQs") they list the following:
"xBrowserSync utilises the browser’s native Web Crypto library to encrypt your browser data client-side before it is transmitted over the internet. For key derivation, xBrowserSync uses PBKDF2 with 250,000 rounds of SHA-256 (as a comparison, LastPass’ key derivation uses a similar approach but with only 100,100 rounds by default). The data is then encrypted using AES-GCM with a random 16 byte IV and the user’s random 32 char sync ID as a salt. This approach ensures your data cannot be decrypted without your sync password (which is never transmitted) so please ensure you use a strong password! If you would like to review the encryption code, the relevant functions are getPasswordHash and encryptData."