If you accept that someone could compromise the web server but be unable to modify the website sent then sure. More generally if you don’t trust the other end you should not be using passwords.