You can if you don't want the authenticating side to actually know the plain text. e.g. password + client_salt => hash => send to server => (hash+server_salt)^

You can if you don't want the authenticating side to actually know the plain text. e.g. password + client_salt => hash => send to server => (hash+server_salt)^hash2 => compare to db By doing this you'd protect a user when their password might be accidentally logged (e.g. Twitter recently). Then if you compromise the hash you don't immediately reveal the password itself, just the text needed to authenticate, which can be changed. If you simply change the salt used client side you may not even need to have the user change their password (although obviously better if they did). That said, I don't think this is required, but there is actually a case for it. Also obviously you should never log the password, but mistakes are made. This helps mitigate the risk of that password being exposed.