AFAIK, the generation of the address pairs occurs on your computer but the concept still makes me nervous as it's occurring in the browser and I have to trust the owner of the site, I think.
If you continue to use the website though, you're trusting the owner of the site to:
- Not change the code in any way that compromises the security of the private key
- Maintain adequate security so that no hacker can change the code in any way that compromises the security of the private key
Unless you read and verify all the site's code (big task and impossible to verify for certain anyway, may be errors in your verification) OR provide your own private keys, there's no way to know the site isn't simply providing private keys from a pool (or mathematical subset) known to the site owner (or whoever may have hacked the site's code). THAT is the major risk. Client-side/server-side makes little difference. I'd even go so far as to say that whole concept (client-side) is false reassurance. The question still comes down to, do you trust the code you are running to provide genuinely random private keys. There's the whole rub.
A site generating your PRIVATE key for you and matching bitcoin addresses? A disaster waiting to happen. There is almost no way to be sure the information is not stored and then, in a few years, used for withdrawal (theft).
Using the code offline is a better idea, but DO check the code first.
Just my 2 Satoshis...