Comment by gorset

If you are running javascript on a page from a server, you are trusting the server with your plaintext.