Note that such system only provides you benefit if the client-implementation is to be trusted. E.g., if your user-agent does it all for you, you could consider

Note that such system only provides you benefit if the client-implementation is to be trusted. E.g., if your user-agent does it all for you, you could consider it trusted, but if all the code is provided by the "untrusted" service-provider that you won't want to see your password, it ends up just being for show. Similar situation with ProtonMail: As long as you use the clients shipped by them (webmail, app), all of the security hinges on nothing but a promise. Their app can read the passwords and keys as much as it wants.