What I am asking is does big tech companies like google have new users to hash their passwords on their browsers before it is sent to the back end?

Do users send their password in plain text then the google servers hash it on their database?

Isn't safer just have the user hash their password on the client-side then have it sent to the Google server? So that it's difficult for guessing what the password is once it is in hashed form.

Doesn't seem to risky to have the database to do all of the hashing, salting and peppering all in one server? What if Google employees start sniffing in user's info right at the moment plain text passwords reach the servers?

Does google follow this method?

  • 6
    If they can sniff the passwords, then they can sniff the hashes, too. If you hash client-side, then the hash becomes the password. The duplicates explain this more fully. – schroeder Apr 18 at 10:40
  • 1
    If you have to respond with "what if somebody invented something completely different?" then you are no longer looking for answers but fiction. "What if tech companies implemented advance algorithm which can detect that a hacker send a hashed password which was not originally typed as clear text?" -- anything provided by the client can be faked by a "hacker". If the client provides it, then a client can provide it; and that's outside the control of the server, by definition. – schroeder Apr 18 at 15:35
  • 1
    "passwords must be cryptography protected during travel and storage" -- that's right: TLS for travel and salted hash for storage. That's the PCI-DSS standard. PCI-DSS does not require that someone invent an entirely new approach just to be compliant. I'm not entirely sure that you know what you are talking about. – schroeder Apr 18 at 15:38
  • 1
    @STo every line you wrote in that comment is false. – schroeder Apr 18 at 16:08
  • 2
    @S To - Anything you do to a password client side becomes the password and is implicitly clear text protected by TLS transport. If you hash the password client side, the hash becomes the password and there is no need to ever know the original password. You could client side hash your password a million times cyclically with a million custom salts but it buys you nothing! The final result becomes the clear text password and that's all anyone needs. – user10216038 Apr 18 at 22:48