Why would you not hash in the browser. Doing so makes sure the plaintext password never even gets to the server while still providing the same security.
Edit: I seem to be getting downvoted… Bitwarden does exactly what I described above and I presume they know more than y’all in terms of security bitwarden.com/help/what-encryption-is-used/#pbkdf…
Please pick a password starting with ad and ending with min (lemmy.world)
Just take the string as bytes and hash it ffs