[darkwater]

If you never use the web frontend that should not be possible (unless the local app/browser extension send the full password over the wire and not the hash).