The only time a server should see a password is when it's generating or comparing against the salted hash using something like bcrypt. There should never be a w

The only time a server should see a password is when it's generating or comparing against the salted hash using something like bcrypt. There should never be a way for a server to retrieve the plain text password. Ever.