Security is a hard problem.  Unless the server knows the password they can't validate Hash(challenge + password).  If you intercept both the challenge and the resulting hash you can brute force the password.  If you have a method of safely sending the password in the first place you should probably use that all the time instead of trying to build a JavaScript system to avoid sending the password in the clear.<p>PS: You could implement all the security features of SSL in JavaScript but that wold be pointless and slow.  If you really wanted to build a custom security system I would recommended using a Java applet, but even with a team of experts it takes years to build something as secure as SSL.