[hunter2_]

"Since if someone has it, they can just send it to the server for auth" unless it's only good for a few moments (the form you type it into constantly polling for a new nonce).

[deepbreath]

The server would not be able to verify a changing hash without knowing the password

[jimktrains2]

Or you could just use PAKE or SRP.