See http digest auth - which is considered obsolete. Mostly because it was conceived as a "more secure" way to send credentials over a clear-text channel: http

See http digest auth - which is considered obsolete. Mostly because it was conceived as a "more secure" way to send credentials over a clear-text channel: https://tools.ietf.org/html/rfc2617#section-3 https://tools.ietf.org/html/rfc2617#section-3 The main issue with a "new" approach vis-a-vis basic etc, is that you need client support (will it work without js). Then there's the question of what you're protecting against: if an attacker knows you accept a single round sha1-hashed pw, it's still easy to brute force through login, but it might require custom rainbow tables to account for the extra hash round. But you'd be better off with a standard pw stretching / storage scheme for defeating off-line attacks.