title: Where should I hash user passwords?
body: <p>The obvious answer is hashing. I'm thinking of using SHA512 to hash a salted password.</p>
  
  <p>My question is this: Where should I hash the password?</p>
  
  <p>I've thought of two ways:</p>
  
  <p>(1) I hash it in the application. That will mean the hash is transmitted to the server. The server then checks it against the stored hash, and logs in the user if the hashes match.</p>
  
  <p>(2) I hash it on the server. The hash is checked in the same way.</p>
  
  <p>My problem is that I feel the password would likely be intercepted. In (1), the hash could be extracted by a man-in-the-middle attack. The attacker can now simply use that hash to get access to the user's information.</p>
  
  <p>In (2), the attacker can intercept the plain-text password, and use that to gain access to the user's account.</p>
  
  <p>Is the solution that I need to hash on both sides? Hash with the salt on the client and then hash again on the server-side?</p>
  
  <p>I am not sure how to proceed. I don't want the user's information to be accessed.</p>
  
  <p>If you can point out the benefits of your suggestion too, I would be thankful.</p>