[thegreatpl]

Actually, Passwords should never be hashed client side. Otherwise, a man in a middle attack could intercept the hash and get your password, allowing them to log in. Instead, the password should be encrypted to the server, and hashed there.

[hvidgaard]

If a MitM attack can get my hash, what do you think they can get if I send the password to be hashed by the server?

[grey-area]

So what does your hash add?

[hvidgaard]

Verifiable protection against data breaches.