[rocqua]

The codebase will always have access to your plaintext password at one point or another.

Not necessarily. The simple solution is client-side hashing. You could combine that with challenge-response to only reveal the password hash to the server once.

[icebraining]

The client-side code that does the hashing is part of the codebase.