True, but there are two reasons for that! One is because I'm too cheap to pay the premium my web host demands for https. The other is because most of the entropy is calculated in your browser via Javascript (even borrowing a JS implementation of SHA-1). It's extremely unlikely that either I (the server), or a third party sniffing packets, could guess the passphrase you generated using passphra.se.