Your local browser will be saving your 'password' unencrypted in the cache and history, and maybe syncing to other devices.

Any workplace security system will probably be keeping records of your 'password'.

Any mistake on the web server could turn on directory listing, revealing the password.

Some other user of the web server, even a sandboxed low privilege process, will often have the ability to list directories.