You can inspect the website and detect a backdoor. It is not easy, but nobody would risk to be caught doing that. On the server side, we have no possibility of knowing what happens.
Also, you could use an extension to generate the signature. The password, in this case, would never be passed to the client.