I've always been intrigued as to why passwords are not hashed and salted client side before sending (and then hashed again on the server side). The usual argume

I've always been intrigued as to why passwords are not hashed and salted client side before sending (and then hashed again on the server side). The usual argument against it is that SSL is better - but I don't see why it shouldn't be standard to do both. It would prevent issues like this (Malicious admins or compromised server) from ever occurring. Assuming the salt is unique to the website it also solves the problem of users using the same password on many different websites - this would no longer be an issue. It would also mean as an end user we can have a look at our login POST request and confirm our password is not sent and therefore cannot be stored in plaintext. EDIT: I see the other discussion and understand the hash now becomes the password so if a hacker obtains the hash they now can login. I'm advocating for it to be hashed server side also, protecting the user from cases just like this one.