Sessions last 30 days on this device. Traffic is plain HTTP on your local network — don't reuse a password you care about elsewhere.