I want to hash passwords for security, but strong bcrypt by nature eat up a bit of resources of the server. So I was thinking to do the encryption on the client side. This would prevent the password from being known in the case the off chance server is hacked.
Client JS encrypts password via bcrypt -> sends to server via TLS -> stored in DB as salted SHA256/512 HMAC
Of course there is a limit of login attempts per account and per ip. And use of captcha.
Also, any sensitive account changes or the like requires the user confirms it in their email.
The primary goal here is mostly to prevent in the off chance the server is hacked, that the passwords would be leaked for other services the user may share passwords. While not wasting much extra server resources.
I am the only one who has access to the database. And obviously once the system is hacked, more than likely everything would be compromised so they can make people enter their plain text passwords by tricking them. (albeit a database can be leaked via an automated hack exploit, where as doing the above would require a targeted hack)
The main goal here is that many places are now passing laws that can hold you accountable if your database is leaked if you did not provide enough security for the user's data. And I want to know if encrypting bcrypt server side offers any realistic advantage over client side bcrypt + server side hmac?