4 ms·

The passwords are generated on the client.

• rnhmjoj 11y ago
  What if someone is listening to your traffic and injects a script which sends generated passwords to a server? http only is a bad idea in this case.