Fix passphrase generation

isn't better to send secret using POST or a HTTP header to remove the need of encoding / decoding in the URL?