Hashing is hardly ever done client side. Most often server side, which is fine, because it's not the same as "storing plain text". In fact, if you rely on clie

Hashing is hardly ever done client side. Most often server side, which is fine, because it's not the same as "storing plain text". In fact, if you rely on client side hashing, you are not only making the app a lot less accessible (it will only work with JS enabled), the security is worse, because now you are publishing a salt to the client. Or you are working with unsalted hashes which is hardly better than just plain text. SSL is what protects passwords in transit. Not some JavaScript client side hashing DIY.