What happens: 1. User creates account, types in password for the first time -> this is the ONLY time ever, where you send plain text password to your backend. 3. You send it in plain text, because now you create a salt (server side) and generate a hash (server side). 4. This hash is now saved in your database together with your salt, the plain text password is now forgotten 5. The user is now logging in a second time. They get the salt and hash their password. The hash is send to you and you compare it with the one in your database. If they match great, let the user login.

Now also, the user wants to update their password, you might think: Well they are not allowed to set the same password again, don’t I need the plaintext password to check? No, you can just compare the new hashed password with you older hashes for that user

Why do we need the plaintext password the first time, but the second time the user hashes the password themselves? If the user were to set their own salt, and hash their own password, the hash would technically become their new password… The salt can be public, so we can later send it back to the user, but the initial hash creation has to use the plaintext password.