This question already has an answer here:
I am creating a PHP website where users, among other things, can login and do administrative stuff. For their passwords i use password_hash($password) and to later verify with it, I use password_verify($password, $pass_from_db).
HTML | password = "1234" | -> JS | encrypt("1234") = "ASU'2j3)k" | -> PHP | password_hash("ASU'2j3)k") = "AlD23J'#sC5"P" | -> Inserted in db
HTML | password = "1234" | -> JS | encrypt("1234") = "ASU'2j3)k" | -> PHP | password_verify("ASU'2j3)k", "AlD23J'#sC5"P" - 'Gotten from db') | ACCEPTED
Is this a good idea, or should I just send the password as cleartext?