Hash and salt it, client side, in the browser. Make it standard. Make it impossible to use a password box without this feature. Get the browser developers to impose this.