Your secret is encrypted in the browser before it leaves your device. The server never sees plaintext.