[rayshan]

Should really highlight the fact that it could be self-hosted [0]. Typing a password and uploading a sensitive file is never a good idea.

[0] https://github.com/louissobel/ppmf

[untitaker_]

At first sight it seems the encryption is done by client-side javascript, so you don't gain much by hosting it yourself.

[herge]

If the javascript comes from your computer (because it's embedded in the page you self-host), how could it get compromised?

[ToastyMallows]

Nothing is uploaded, it can run offline once the page is loaded.