Don't just avoid sending plaintext passwords, also avoid storing them! Storing plaintext passwords makes all of your users vulnerable if someone gets their han

Don't just avoid sending plaintext passwords, also avoid storing them! Storing plaintext passwords makes all of your users vulnerable if someone gets their hands on your database. Instead, store the salted hash of the password, something like sha1(password + 'this string is a secret!'). When a user tries to log in, compute the hash again, and compare it to the one you stored.