It is interesting to consider the potential benefit, but I don't see how this really helps at all. If someone is controlling your access to a service (either MITM or a corrupt sysadmin), then it is pretty much game over. They could just send down a login form without the hashing client side. Recommending that people encrypt a SHA-1 hash of the user's password in their database is nuts. There are well understood and proven solutions to this problem - check out OWASP or NIST's updated advice. Unfortunately you just have to rely on the service provider to just do a good job. The only sane solution is: * rely on federated authentication where possible - I trust Google/Microsoft/Facebook to do a good job of storing my password (they have more to lose) * the service should follow OWASP guidance (salted PBKDF2/bcrypt with stretching) and offer 2FA based on TOTP. The top answer here gives a much more succinct appraisal. https://security.stackexchange.com/questions/53594/why-is-client-side-hashing-of-a-password-so-uncommon