&gt; Passwords&#x2F;passphrases could be salted hashed by the browser in JavaScript<p>Not the worst idea from the developer&#x27;s point of view, but it doesn&#x27;t protect the user: the site could still serve bad JavaScript which didn&#x27;t properly hash the password (this, for example, is why Mozilla accounts are completely, totally and utterly insecure, and why Firefox password storing should never be used by anyone who doesn&#x27;t wish to share his passwords with Mozilla, any Mozilla employee and any state which can compel any Mozilla employee).  The browser needs to natively support doing this.<p>There&#x27;s also the issue of replays.  This topic has been well-studied; I believe that Secure Remote Password (SRP) is currently the gold standard for this.