Does using web3.eth.personal.unlockAccount(..) send the password for the account as plaintext to the provider?

Question

I have a customchain running on a private server. I am also running a provider using geth, to which I am connecting from the browser using let web3 = new Web3(http://xxxxxx:8545).

My browser client connects to the provider and can issue transactions after they unlock the account using web3.eth.personal.unlockAccount(..., password).

The [web3.js documentation][1] states:

Sending your account password over an unsecured HTTP RPC connection is highly unsecure.

This confused me because I assumed that the browser recieves the keystore json object from the server, does the decryption locally using a password, and uses the unlocked account to sign transactions, which are send to the provider who then in turn would send this transaction to the chain.

The above quote from the documentation makes me think that the password may be sent to the provider and the provider does the signing etc. This obviously is not the case.

So my question is this: "At any point, does the web3.js client send the password to the provider?" [1]: https://web3js.readthedocs.io/en/v1.2.7/web3-eth-personal.html#unlockaccount

Answer 1

Thanks @MajdTL for the clarification. I understand now that the unlockAccount(...) method actually unlocks the account for everyone on the blockchain and not just for the client on the browser.

There is a way to use simply the keystore json file that is generated when an ethereum account is created.

1. load the keystoreV3 json into a js object, say keystore.
2. instantiate an account object: mydecryptedaccount=web3.eth.accounts.decrypt(keystore, "password");
3. add this account object into the local wallet: web3.eth.accounts.wallet.add(mydecryptedaccount);
4. Sending transcations then works by setting defaultAccount parameter to mydecryptedaccount.address for either web3.eth.accounts.wallet or somecontract.