I use JavaScript on some password fields for client-side password hashing (reasoning: https://security.stackexchange.com/a/201099/10863 https://security.stackex

I use JavaScript on some password fields for client-side password hashing (reasoning: https://security.stackexchange.com/a/201099/10863 https://security.stackexchange.com/a/201099/10863), but I agree that this might be a useful thing. I can think of a few ways this could work: - Blacklist or whitelist access: <input type=password nojs> or <input type=password allowjs> - Specifically set a method that is called upon form submission: <input type=password onsubmit=hashPassword> <script>function hashPassword(value){ ... }</script> The catch here is that the browser would have to error out on reassignment of the hashPassword global variable, since that is what malware would do. This sounds easy, but it might be quite a bit more complexity for the browser's JS engine, since it has to check every assignment in the global scope against a list of functions that are used for password fields. - Only allow access from the code path starting with the form's onsubmit event, so <form onsubmit="return validate(this)">. The catch here is that most modern websites do $("#myform").onsubmit=function(){...} which any malware could do as well, so that would have to be disallowed. A lot of devs wouldn't be happy about that. Though for backwards compatibility, the opt-in method would probably be the only candidate for actual implementation in the foreseeable future.