Password hashing at client browser
hash, passwords, security
Solution
Use javascript to calculate the hash. See this for an example on how to calculate SHA-1 hashes in JS.
Beware that if you make yourself dependant on Javascript, your system will fail as soon as someone has JS disabled. You should use HTTPS if this is a concern to you, which has its own setbacks (e.g. certificates cost money if you want them to be immediately accepted by browsers.)
Problem
What's the best way to hash the user password at the client browser, before sending it to the web server, so that only the hash goes out, not the plain-text password? EDIT: assuming HTTP is used (not HTTPS)