You can even do non-random brainwallets, like:

https://cryptap.us/uno/jswallet/#DoNotStealThisBrainwalletOrYouAreAThief

But that's certainly not recommended.

If you add a password during the creation of the wallet, only part of the hash is saved in the bookmark URL. You will need to supply the full password to unlock it (the javascript checks the full hash of the password to compare a partial match).

KryptoKit did a good job here, no RushWallet has been compromised that I am aware of. To my knowledge, it should be safe to store long term (just keep a copy of the paperwallet site or export the private key in case I disappear some day).