Your approach doesn't work for people without js, and is ineffective against man-in-the-middle-attacks. You still need https to secure against people modifying

Your approach doesn't work for people without js, and is ineffective against man-in-the-middle-attacks. You still need https to secure against people modifying the page so they get the plain password, and if you are going https, the js stuff isn't needed. Here's all you need to know: http://stackoverflow.com/a/477578 http://stackoverflow.com/a/477578