Derive a 256-bit key from your password, then send that 256-bit key to the server.  Nobody is ever going to perform a brute-force search against the 256-bit derived keyspace, so any attack will need to run the KDF against a list of likely passwords in order to get a list of likely keys.