When you enter a password by hand, your browser knows what you entered. How do you know the browser isn't transmitting to the mothership? Because you trust the company that supplied it.
You can't function offline with a 100% guarantee of security and privacy. The best you can do is to only allow openings to people you trust. Naturally, you should extend your trust with care, but if a company is doing business with a lot of people like you, it's in their interests not to abuse your trust — particularly when their whole business model depends on it.
Rather than worrying about conspiracies to steal your passwords, you should worry about unintended releases of your information. Do they have competent security people? Are the stored passwords encrypted in a way that allows unauthorized access?