Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

2
  • Client-side hashing seem more like a courtesy to the user to not accidentally reveal the "true" password (In combination with using transport security). And server-side hashing a requirement to mitigate database-theft. But I don't get why client side hashing would save work for the server? I mean wouldn't it still have to apply the same slow hash no matter how the original password was hashed client side? Commented May 11, 2017 at 12:18
  • 2
    @AndreasZita - This is the main reason for client side hashing, to releave the server from the heavy work. The client will take on the heavy part with key-stretching (e.g. BCrypt), and the server can just calculate a fast hash (like SHA-256). This is safe because the BCrypt hash is such a strong password, that it cannot be brute-forced successfully, even with a fast hash, and because the time consuming part must still be done in a dictionary attack. Commented May 26, 2017 at 6:23