You don't store them as plain text, you store them as hashes. And then you send a server salt/nonce and the browser hashes the plain text password with the sal

You don't store them as plain text, you store them as hashes. And then you send a server salt/nonce and the browser hashes the plain text password with the salted hash in your database and then with the server salt/nonce. Still HTTPS solves nothing of that. I don't even know what Digest is... I'm talking this RFC: https://datatracker.ietf.org/doc/html/rfc2289 https://datatracker.ietf.org/doc/html/rfc2289