3 ms·

For all intents and purposes, they must, at least when you login via a web browser.

• morgante 13y ago
  Not technically. You can do client-side encryption so that only the hash is sent, via Javascript.