This question already has an answer here:
The way I understand password security is that the user enters a password, which is then converted using a hash function. The website then compares it to the stored hash to see if it is correct.
That way only the hash is stored, so if an attacker learns that they don't have the original password. Where exactly is it converted to a hash? If it is done clientside, I would expect that an
attacker who knows the hash could modify clientside code to send that directly to the server.
But if done serverside, then the plaintext password has to be sent across the network,
which seems like it is a security problem if an attacker is able to listen to the connection.
Which of these methods is used, and how are the potential security flaws addressed?