Facebook Vice Presidents Bet On PasswordBox

So obviously the real question is about PasswordBox's security. Does the server do the encryption/decryption or does the client do it, then send the info to the server?

I'm working on an iOS/Mac OSX app that should be launching very, very soon that does all encryption/decryption on the client and sends the info to the cloud after it has already been encrypted. The password used to create the AES encryption key is never seen nor understood by the server. The server is just a box to put previously encrypted data in.