What I am asking is does big tech companies like google have new users to hash their passwords on their browsers before it is sent to the back end?
Do users send their password in plain text then the google servers hash it on their database?
Isn't safer just have the user hash their password on the client-side then have it sent to the Google server? So that it's difficult for guessing what the password is once it is in hashed form.
Doesn't seem to risky to have the database to do all of the hashing, salting and peppering all in one server? What if Google employees start sniffing in user's info right at the moment plain text passwords reach the servers?
Does google follow this method?