I can understand your point of view and I do believe, that it will take time, to trust online services that deliver such sensitive data as passwords and ids. That is why it is open source - to be transparent from the beginning. Nevertheless it seems to me that more an more (micro) services will emerge and replace a lot of the "classic" software that we are used to and accustomed to have offline.
Regarding the "offline uuid" - currently working on creating a npm package for offline usage. Will be available soon.
Regarding the Content-Type: it is set currently automatically to "text/html" when generating only one item (no matter if it is password, uuid or word list) and to "application/json" when generating more than one item. The idea was that the default option for each endpoint (one item, default settings) should deliver a result that can be used/copied immediately and not be formatted, if the api was called in the browser. I guess it would be fine to set text/plain when delivering one item. Thanks for the hint.