Even if some mechanism such as encryption could absolutely prevent the pad's being intercepted, you'd still have no way to be sure the site generating the pad didn't keep a copy in a file, conveniently tagged with your Internet address. In order to have any degree of security, it is essential that the pad be generated on your computer, without involving any transmission or interaction with other sites on the Internet. A Web browser with JavaScript makes this possible, since the generation program embedded in this page runs entirely on your own computer and does not transmit anything over the Internet. Its output appears only in the text box, allowing you to cut and paste it to another application. From there on, its security is up to you.
Security is never absolute.
JavaScript interpreter may contain bugs or deliberate security violations which report activity on your computer back to some other Internet site. Some other applet running on another page of your browser, perhaps without your being aware of its existence, is spying on other windows. Some other application running on your computer may have compromised your system's security and be snooping on your activity. Somebody may come along later and recover a copy of the pad from that log. The implementation of this page may contain a bug or deliberate error which makes its output predictable.