The Aksara ledger needs JavaScript to derive your password locally - it never sends the password itself.