> When the user submits their password, it SHOULD be hashed client-side and only the hash SHOULD be sent to you. No. If you are going to do something like this

> When the user submits their password, it SHOULD be hashed client-side and only the hash SHOULD be sent to you. No. If you are going to do something like this, do it properly with something like a zero-knowledge password proof. As you describe it you are introducing a huge flaw: If your password database leaks, an attacker now has everything they need to log in to user accounts, no password hash attacking required.