For sure, you should use a nostr signer extension (like nos2x, alby, etc) when logging into a web client, rather than directly inputting your nsec.