not as bad since the blast radius is only your chat vs. knowing your password exposes all your data.

however - agree that this is not great - espeically if chat TTL is long. someone who gets your URL can read everything you're asking (eg. by sniffing your network/accessing your browser history)

You don't store your password in the URL.