This question already has an answer here:
Suppose I sign up for website.com with username "John" and password "Secret".
Currently the webbrowser supplies website.com with my real plain text password, and we must trust them to salt and hash it properly so that if they are hacked, damage to users is minimized.
Why don't web browsers hash and salt your password for you? What would the downsides be if instead, it communicated:
username: John password: Sha256("website.com|john|Secret") => "655cd29ded358433da16867b682c21621664d26b9ca493ab224488dffce17050"
Maybe it's not the best scheme in the world, but is it worse than nothing at all?
With this scheme websites would have to keep track of which domain you signed up under, and you would probably want to modify the username to be all lowercase in the hash function so that the web browser communicates the same password no matter how you case your username.
The reason I suggest including domain or some other company id in the hash is so that rainbow tables can't be used for more than one site at a time.