I think the point is that if the password is one that's used elsewhere, if it's client-side encrypted, at least it can't be captured for use on another site by

I think the point is that if the password is one that's used elsewhere, if it's client-side encrypted, at least it can't be captured for use on another site by an eavesdropper. It does nothing against an attacker who can get in the middle of the transmission though.