I'm writing a web app for Personal Information Management that runs in the Cloud. For that I'm considering client-side encryption using AES256 with window.crypto and SJCL as fall-back for older browsers. The encryption would then be based on the user's login password. In addition, I'm also thinking of doing the password hashing on the client side.
Is that actually increasing user privacy? Or am I missing anything? I know the standard way is to just store data "plain text" and do server side hashing.
EDIT To add a clearer scope, the intention is: in case the database gets stolen, the user data should be difficult to read. (At least it won't be plain data in that case.) At the same time, when user email@example.com's uses 123456 for his mail account and for his WebApp PIM account, an attacker still has to reverse the password hash in order to access foo's Gmail.com.
In particular imagine the following scenario: an attacker can get the database and checks user firstname.lastname@example.org's database records. He gets the hash, and some encrypted user data. With the hash he can login to WebApp PIM's API. However he can not read the user's data.
With the leaked hash, the attacker could easily compromise the data through the API, but that doesn't matter so much for this scenario. The primary goal is to increase privacy of the user data in case of a database leak.
(In addition I would like to allow the user to at least slightly distrust the WebApp hoster reading private data. I'm sure this solution doesn't get close to that, but at least it could be a first step.)
Regarding performance: the Web Crypto API can do PBKDF2 which seems fine to me for hashing. (Github Example) SJCL might be too slow as fallback, so it might make sense to transpile C++ to (asm.)js.