- Is it safe to send password to backend?
- How do passwords pass securely from server to client?
- Should I hash the password before sending it to the server side?
Is it safe to send password to backend?
If you hash the passwords in the backend, an attacker has to first crack them to use them on your website. but if you hash them in the frontend, an attacker doesn't need to do this, they can just pass the hash as it is stored in the database.
How do passwords pass securely from server to client?
This is usually overcome by encrypting the communication between the user and the server. The most common form of encryption is the Transport Layer Security (TLS) standard or the older SSL standard (Secure Socket Layer).
Should I hash the password before sending it to the server side?
It should be irreversibly hashed before leaving the client as there is no need for the server to know the actual password. Hashing then transmitting solves security issues for lazy users that use the same password in multiple locations (I know I do).