passwords are generated using javascript (no transmission from server to browser)