Any.Do transmits Passwords in plaintext. == Some of you may be interested to know that the Task Management and TODO-list Application, Any.Do, happily transmits your password and just about everything else in plaintext. They were even so kind to include a README.md documenting exactly this "feature": >>> Login >>> ----- >>> >>> * Right now, the only form encoding call done to the server is the login process. >>> * Only POST is supported. >>> * The parameter *_spring_security_remember_me* should always be specified. >>> * Password is not encoded/encrypted in the request. >>> >>> Endpoint: /state-manager/j_spring_security_check >>> >>> POST parameters: >>> >>> { >>> j_username: , >>> j_password: , >>> _spring_security_remember_me: "on" >>> } Just to verify this is actually happening I made use of wireshark: http://imm.io/ODou