I am currently implementing a simple login system. I would like to securely store all the user passwords in my database. The passwords are the most important components. All the other user data is not important. If an account gets hacked, as long as the password cannot be figured out its fine; other data are things like: score and account creation date.
I am assuming that some of my users will be using the same password as they are for other sites. So i need to make sure that the password cannot be read by a potential hacker.
Can I generate the Hash on the client side somehow to avoid any hacker ever seeing the real password?
Before you say I shouldn't do it on the client. The server has a constant game loop that needs to run, and I don't want the game to lag every time someone registers an account or tries to login. This approach would take some of the load off the server.
EDIT: Since this question was closed I would like to elaborate. Moving to the client allows me to use a lot more rounds when hashing the password, since this wont affect the server or other users experience in any way. This also makes it much easier to prevent a user from spamming requests and slowing down the server.