Passwords are hashed in your browser (PBKDF2-SHA-256, 310k rounds, random salt). Accounts live only on this device.