Until the author decides to change it to send the passphrases to the server, or someone MITM you and injects code to do the same thing. Basically, it's a bad i

Until the author decides to change it to send the passphrases to the server, or someone MITM you and injects code to do the same thing. Basically, it's a bad idea to start typing passphrases into an untrusted, unencrypted web page, regardless of whether it does anything bad right now.