I think this is in an incredibly bad way to create passwords, at any given moment they could swap out the js so that it phones home and then boom your insecure.