>I guess OP thinks that vanity-eth.tk is a website with server side code.
I am fairly certain that very few people go and read the entire supposedly client-side JS code served by that site. It takes a very tiny bit of obfuscated JS to send 256 bit somewhere else.
[edit]: and when you generate a key pair that's going to potentially store multi kUSD in value, trusting anything that happens in a browser is - call me old fashioned - suicidal.
I am fairly certain that very few people go and read the entire supposedly client-side JS code served by that site. It takes a very tiny bit of obfuscated JS to send 256 bit somewhere else.
[edit]: and when you generate a key pair that's going to potentially store multi kUSD in value, trusting anything that happens in a browser is - call me old fashioned - suicidal.