The codebase will always have access to your plaintext password at one point or another. Not necessarily. The simple solution is client-side hashing. You could

The codebase will always have access to your plaintext password at one point or another. Not necessarily. The simple solution is client-side hashing. You could combine that with challenge-response to only reveal the password hash to the server once.