Urls and some other fields are stored plaintext. So yes, you’re safe from bruteforcing passwords. But still lost privacy / doxxing / spear fishing info.