Its not completely clear ATM whether or not that while using an internet-based client (not connecting to localhost/127.0.0.1) that the passphrase is sent to the site.
It certainly does get sent to the remote site, believe me. I looked at the http request headers in the very beginning when using a remote client was suggested, and started warning people against doing it. Now that https is supported, at least you are protected against your ISP / tor exit node sniffing your traffic, but you still have to trust the remote Nxt node owner.
It *could* just reside locally on the java app thats run in the local PC.
Just to clarify, if you are accessing somebody else's node, there is no java running on your local PC, what you see in the browser is done with javascript. But even if somehow decoding of the password was done locally, in the browser, you would still have to trust that remote node owner - because he (or somebody in between) could have added malicious javascript that nevertheless captures and sends him you password.
Bottom line - use localhost.