The decryption is performed in the browser, the password is never sent over the network.