fedichat registers itself as an app on your instance and sends you to its authorization page. Your password never touches fedichat — only a token comes back (OAuth 2 + PKCE).