The client side crypto is only as strong as the server side security. If, as an example, I get DigitalOcean to reset the password on the VM (or any other way to access the web servers) then I can simply add another line to the JS to post the plaintext data to a server of my choice. Game over.<p>You should use PF if you trust them not to be compromised (hacked or be malicious) and not to backdoor the software. It shouldn&#x27;t hinge on the client side crypto.