Wow, this is still even a thing.<p>The form, all its js assets and form api endpoint all have to be secured.  And https for everything that contains code.  Deploying SRI for web pages over https is also another layer of defense against js tampering.<p>Also, sending passwords across the wire in any reversible manner is really more dangerous than is necessary. Passwords&#x2F;passphrases could be salted hashed by the browser in JavaScript using a PBKDF similar to scrypt or bcrypt, before being sent to the backend for constant-time comparison... it just takes a little more prudence and effort, but it&#x27;s absolutely doable.