This question already has an answer here:
What steps must be followed to send password securely from the user registration page (i.e. client side) to the server over a non encrypted channel (http) when the user registers for the first time on the website? (We assume that there exists an intruder in between client and server)
should the password be encrypted with algorithm like AES (requires private key to be shared between client and server which might not be safe) or hashed using SHA2 on the client side before sending it to the server for further hashing using PBKDF2 or bcrypt.