Is clientside encryption to hide data from server safe when using SSL?
Client-side encryption can prevent a passive eavesdropper on the server's memory—like Heartbleed—from seeing the client's secrets.  But, if you might be concerned about any more serious compromise of the server, who delivers to the client the JavaScript code that performs encryption?