So we are really getting passwords from remote hosted websites? Are people really about to copy, paste and use these right out of the browser?
Even if the site knew for certain that you had used one of the passwords, they would have no idea where you used the password, and they wouldn't know your username or other credentials.
They might not even have any way of accessing the system you're putting the password into.
I'm sure a lot of people will use these sorts of sites to generate a whole bunch of passwords, and not even use any of them.
I agree, the risk is minimal. Nevertheless.. security, heh.
Payload decoders and password generators are some of the biggest honeypots out there. Combining this with an attack taking advantage of hidden form autofill, you could gain quite a bit of information to go along with that password.
If I were to recommend novices to use it-- I'd tell them to use a password manager locally, and something like that to generate a secure password to get into their own machine locally / get into their password manager-- which mitigates most of the risk if it turns rogue.