A CSR is a request, not a certificate — and doesn't need to be secret

A Certificate Signing Request bundles a public key and identity information (Common Name, Organization, and so on), all signed by the corresponding private key to prove the requester actually holds it — it's the thing you hand to a Certificate Authority, which then issues an actual certificate back. Because a CSR only ever contains the public key, not the private one, it's safe to email, paste into a CA's web form, or hand to a colleague; the private key generated alongside it is the part that needs protecting, and this tool generates both in the same browser tab specifically so the private key never has to be typed, copied through a third system, or transmitted anywhere before you've had a chance to save it.

Why the private key is shown exactly once

This page deliberately keeps no server-side or persistent copy of the generated private key — it exists only in the browser tab's memory for as long as the page stays open, and is gone the moment you navigate away or reload. That's the correct security posture for key material (nothing should retain a copy it doesn't need to), but it also means there is no "I forgot to save it, can I get it back" recovery path: if you generate a keypair here and lose the private key before saving it, the only fix is generating a new keypair and CSR from scratch, since the old certificate request (and any certificate issued from it) is now useless without the key that proves you control it.