The problem with client-side hashing is that the client-hashed password then becomes the password. An attacker doesn't care if the password being sent to the se

The problem with client-side hashing is that the client-hashed password then becomes the password. An attacker doesn't care if the password being sent to the server is "password123" or if it's "e2389cbb675c3ef00879482bd1702f76", because either way, all the attacker needs to do to log in as you is send that "e2389cbb..." string to the server. I suppose double hashing would have the benefit of preventing your server from ever seeing the plaintext password, but I'm don't think I've ever seen that be a major concern.