I've done this in my own web application, and since the whole web application is built on Javascript anyway, it's never been a problem. I also hash the passwor

I've done this in my own web application, and since the whole web application is built on Javascript anyway, it's never been a problem. I also hash the password again serverside, so: * Only the client knows the plaintext password * The plaintext password is never transmitted over the network * The hash stored on the server isn't enough to sign in to the account