[MattGaiser]

What’s the security difference with two instead of one?

[kevin_thibedeau]

You can have more sophisticated algorithms like SRP that don't send password hashes.

https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...