This question already has an answer here:
- What to transfer? Password or its hash? 4 answers
I have just realized, that my web application is sending unencrypted passwords from login form. It's just like that -- I've analysed, that string sent by user from login form is hashed with MD5 (which is wrong itself -- but that's a different story) on server-side and compared after that (passwords in DB are hashed).