I've found that contemporary browsers will no longer execute JS in opened files of HTML (check the JS console in the browser or the browser log for messages to this effect). In order to function, the page needs to be hosted by an HTTP server locally (or, at least for Chromium, a command-line option must explicitly be provided).

The GH page version will work just fine as an app and is as private as any github HTTPS connection (so, vulnerable to MITM conducted by your local sovereign state TLA actor).

Nevertheless, perhaps stealingadapting Ian Coleman’s BIP39 JS solution would be preferable.

Cheers

Graham