I want to store the passwords of accounts hashed into a database that can be accessed through a python-flask application. When you would login, this python application is supposed to provide you with a token that will be saved in the frontend so it knows who's logged in. The thing that confuses me here, is that the passwords should definitely be hashed in the react application so there's never any plain-text passwords sent over the network. But that also means that comparing the password to the saved hash happens on the frontend, at least when I want to use bcrypt:

hashedPassword = bcrypt.hashSync(passwordFromSignupForm, bcrypt.genSaltSync());
doesPasswordMatch = bcrypt.compareSync(passwordFromLoginForm, existingUser.hashedPassword);

This generates a different hash for the same input. And I suppose that's how it's supposed to be done, because people do recommend this way of working. But how would I let the flask application know that the login was succesful? I mean... I can't just send an "okay" to the backend and expect a token back, right? I feel like that can be highjacked really easily. This makes me think that the check if the inserted password was correct, should be done by the python backend and not by the react frontend... But then again, never send plain text passwords over the internet.

So how can this be solved? Thanks in advance!

1 Answer 1


You have to send the password to the backend, not a hash of it, so the server can verify it matches on its own. You should never send a plaintext password over unencrypted internet (no tls) but once you have the certificate it's usually safe, you could also encrypt it but as both the encryption method and the password must be available on both sides so attackers could get that from the frontend to decrypt the password anyway.

  • 1
    Oh so basically passwords are only protected by tls on their way to the server... I always thought they were hashed on the client side. But this does make life a lot easier. Thanks a lot for your clear answer!
    – DrRonne
    Commented Oct 26, 2021 at 20:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .